CVE-2026-106453 yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size...

CVE-2026-106453

The yawkat LZ4 Java library is vulnerable to a memory exhaustion issue in versions prior to 1.11.2 . The LZ4DecompressorWithLength component incorrectly trusts a four-byte decompressed-length header from the input without prior validation. An attacker can provide a small (e.g., five-byte) input t...

CVE-2026-43284-DirtyFrag-PoC

CVE-2026-43284 — 4-byte XFRM/ESP Proof-of-concept local privilege escalation via XFRM/ESP page-cache corruption 4-byte write primitive · 48 iterations · 192-byte ELF overwrite · unprivileged user + netns Proof of concept Left: kernel preflight, setuid scan, and exploit chain · Right: root shell...

CVE-2026-31431-Analysis-and-Fix

CVE-2026-31431 "Copy Fail" — Technical Deep Dive Severity: CVSS 7.8 High Class: Local Privilege Escalation Introduced: Linux 4.14 2017 Fixed: commit a664bf3d603d 1. Background CVE-2026-31431 is a local privilege escalation flaw in the Linux kernel's algifaead module — the AEAD socket interface of...

CVE-2026-6042: Inefficient Algorithmic Complexity

A security flaw has been discovered in musl libc up to 1.2.6. Affected is the function iconv of the file src/locale/iconv.c of the component GB18030 4-byte Decoder. Performing a manipulation results in inefficient algorithmic complexity. The attack must be initiated from a local position. To fix...

CVE-2024-46853

In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length to fix the out-of-bounds issue when writing the data that is not 4 byte aligned to TX FIFO. To reproduce the issue, write 3 bytes data to NOR chip. dd...

CVE-2024-43410 Russh has an OOM Denial of Service due to allocation of untrusted amount

Russh is a Rust SSH client & server library. Allocating an untrusted amount of memory allows any unauthenticated user to OOM a russh server. An SSH packet consists of a 4-byte big-endian length, followed by a byte stream of this length. After parsing and potentially decrypting the 4-byte length,...

CVE-2023-52628 netfilter: nftables: exthdr: fix 4-byte stack OOB write

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv-len is a multiple of 4, then dstlen / 4 can write past the destination array which leads to stack corruption. This construct is necessary to clean the remainder of t...

CVE-2023-44186

An Improper Handling of Exceptional Conditions vulnerability in AS PATH processing of Juniper Networks Junos OS and Junos OS Evolved allows an attacker to send a BGP update message with an AS PATH containing a large number of 4-byte ASes, leading to a Denial of Service DoS. Continued receipt and...

PyFriBidi Buffer overflow in the fribidi_utf8_to_unicode function

Buffer overflow in the fribidiutf8tounicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service application crash via a 4-byte utf-8 sequence...

CVE-2020-35655

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled...

CVE-2020-35655

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled...

PT-2020-4097

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 16.1R7-S6 Junos OS versions prior to 16.2R2-S11 Junos OS versions prior to 17.1R2-S11 Junos OS versions prior to 17.1R3-S2 Junos OS versions prior to 17.2R1-S9 Junos OS versions prior to 17.2R2-S8 Junos OS versions...

CVE-2019-18218

cdfreadpropertyinfo in cdf.c in file through 5.37 does not restrict the number of CDFVECTOR elements, which allows a heap-based buffer overflow 4-byte out-of-bounds write...

Linux/x64 - XANAX Decoder Shellcode (127 bytes)

Linux/x64 - XANAX Decoder Shellcode 127 bytes ; Date: 08/04/2019 ; XANAX Decoder ; Author: Alan Vivona ; Description: Reverts the xor-add-not-add-xor sequence using the same 4 byte key and executes the encoded payload. ; Tested on: x86-x64 GNU/Linux global start section .text keys.xor1 equ 0x29...

x64 Linux bind TCP port shellcode 81 bytes, 96 with password

x64 Linux bind TCP port shellcode 81 bytes, 96 with password. Shellcode exploit for linx86-64 platform / Author: Sean Dillon Copyright: c 2014 CAaNES, LLC. http://caanes.com Release Date: December 19, 2014 Description: x64 Linux null-free TCP bind port shellcode, optional 4 byte password Assemble...

linux/x64 bind TCP port shellcode 81 bytes

x64 Linux bind TCP port shellcode 81 bytes, 96 with password / Author: Sean Dillon Copyright: c 2014 CAaNES, LLC. http://caanes.com Release Date: December 19, 2014 Description: x64 Linux null-free TCP bind port shellcode, optional 4 byte password Assembled Size: 81 bytes, 96 with password Tested...

linux/x64 reverse TCP connect shellcode 85 bytes

x64 Linux reverse TCP connect shellcode 77 to 85 bytes, 90 to 98 with password / Author: Sean Dillon Copyright: c 2014 CAaNES, LLC. http://caanes.com Release Date: December 19, 2014 Description: x64 Linux null-free reverse TCP shellcode, optional 4 byte password Assembled Size: 77 - 85 bytes, 90 ...

CVE-2014-3818

Juniper Junos OS 9.1 through 11.4 before 11.4R11, 12.1 before R10, 12.1X44 before D40, 12.1X46 before D30, 12.1X47 before D11 and 12.147-D15, 12.1X48 before D41 and D62, 12.2 before R8, 12.2X50 before D70, 12.3 before R6, 13.1 before R4-S2, 13.1X49 before D49, 13.1X50 before 30, 13.2 before R4,...

Juniper Junos BGP UPDATE 'rpd' Remote DoS (JSA10653)

According to its self-reported version number, the remote Juniper Junos device is affected by a denial of service vulnerability due to improper handling of BGP UPDATE messages using 4-byte AS numbers. A remote attacker can exploit this issue, by sending a specially crafted BGP UPDATE packet, to...