Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

CVE-2021-31166

CVE-2021-31166 Por qué Recientemente escribí un exploit para CVE-2021-31166, explota CVE-2021-31166 y CVE-2021-31166. Un pentester debería usar https://github.com/mauricelambert/CVE-2021-31166, pero en los equipos SOC necesitamos conocer la vulnerabilidad específica para corregirla adecuadamente,...

cve-2022-21907

CVE-2022-21907 Go语言应用 by 1vere$k CVE-2022-21907 - http.sys驱动中的双重释放（Double Free）。 摘要 这是一个多线程的 Golang 应用，允许同时向多个目标发送请求。 对于 POST 请求效率不高，但与线性方法相比，它能提供接近 30% 的速度提升。 未经身份验证的攻击者可以发送一个带有 "Accept-Encoding" HTTP 请求头的 HTTP 请求，触发 HTTP 协议栈（http.sys）中未知编码列表的双重释放，导致内核崩溃。 使用方法 Golang ： root@kitploit: Golang: 1...

CVE-2022-21907-http.sys

CVE-2022-21907 - http.sys 驱动程序中的双重释放 CVE-2022-21907 - http.sys 驱动程序中的双重释放 概要 未经身份验证的攻击者可以发送带有“Accept-Encoding”HTTP 请求头的 HTTP 请求，在 HTTP 协议栈（http.sys）处理数据包时，于未知编码列表中触发双重释放，最终导致内核崩溃。 易受攻击的系统 Windows Server 2019 和 Windows 10 版本 1809 : ❌ 默认情况下不易受攻击。除非你在...

CVE-2021-31166

CVE-2021-31166 检测利用CVE-2021-31166（HTTP协议栈漏洞）的尝试 Suricata规则 Zeek包 参考来源 https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166 https://github.com/0vercl0k/CVE-2021-31166...

cve-2022-21907-http.sys

cve-2022-21907-http.sys by 1vere$k CVE-2022-21907 - Doble liberación en el controlador http.sys. Resumen Un atacante no autenticado puede enviar una solicitud HTTP con una cabecera de solicitud HTTP "Accept-Encoding" que desencadena una doble liberación en la lista de codificaciones desconocida...

CVE-2021-31166-Exploit

CVE-2021-31166-Exploit 针对MS HTTP协议栈RCE漏洞（CVE-2021-31166）的利用程序 精心构造的HTTP请求指向存在漏洞的Windows版本将导致DOS攻击。服务器将以蓝屏错误重启。 Http.sys是Windows内核驱动程序，负责处理HTTP请求并构造响应。 此存在漏洞的http.sys驱动程序无法处理特制的"Accept-Encoding"头部，导致崩溃，进而服务器重启。 在蓝屏上，我们可以看到错误信息"停止代码: KERNEL SECURITY CHECK FAILED" 这是一个严重漏洞，CVSS评分为9.8，易于利用。...

Debian dla-4706 : ruby-rack - security update

The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4706 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4706-1 [email protected]...

Uncontrolled Resource Consumption (Denial Of Service)

io.netty, netty-codec-http is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the HttpContentEncoder maintaining an unbounded acceptEncodingQueue that stores attacker-controlled data without any size limit, which allows an attacker to exploit HTTP/1....

Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service

Impact HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained...

MGASA-2026-0226 Updated ruby-rack packages fix security vulnerabilities

CVE-2026-26961 Greedy multipart boundary parsing can cause parser differentials and WAF bypass. Forwarded header semicolon injection enables Host and Scheme spoofing. CVE-2026-34230 Quadratic complexity in Rack::Utils.selectbestencoding via wildcard Accept-Encoding header. CVE-2026-34763 Root...

USN-8182-1: Rack vulnerabilities

Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. CVE-2026-26961 William T. Nelson...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Rack vulnerabilities (USN-8182-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8182-1 advisory. Andrew Lacambra discovered that Rack did not properly parse certain regular...

Linux Distros Unpatched Vulnerability : CVE-2026-34230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with...

SUSE CVE-2026-34230

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...

CVE-2026-34230

A flaw was found in Rack. An unauthenticated attacker can exploit a vulnerability in the Rack::Utils.selectbestencoding method by sending a specially crafted Accept-Encoding header with numerous wildcard entries. This leads to quadratic time complexity during processing, causing disproportionate...

EUVD-2026-18378

Rack has quadratic complexity in Rack::Utils.selectbestencoding via wildcard Accept-Encoding header...

GHSA-V569-HP3G-36WR Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Summary Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted...

Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Summary Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted...

CVE-2026-34230

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...