CVE-2026-49975-POC

CVE-2026-49975 — HTTP/2 爆弾 PoC CVE-2026-49975 の概念実証エクスプロイト。HTTP/2 サーバー実装におけるリモートサービス拒否の脆弱性です。Quang Luong Calif Security Research によって発見され、2026 年 6 月 2 日に公開されました。 許可されたセキュリティテストにのみ使用してください。所有していない、またはテストする書面による許可を得ていないインフラストラクチャに対して使用しないでください。 動作原理 この攻撃は、2 つの HTTP/2 プロトコルメカニズムを連鎖させます。 1. HPACK...

Proof-of-Concept-POC---CVE-2026-49975-HTTP-2-Bomb-

CVE-2026-49975 - HTTP/2 Bomb: доказательство концепции Описание CVE-2026-49975, также известная как HTTP/2 Bomb , представляет собой уязвимость удаленного отказа в обслуживании DoS, затрагивающую большинство основных веб-серверов в их конфигурации HTTP/2 по умолчанию. Уязвимость была обнаружена...

CVE-2026-0897

CVE-2026-0897 — Google Keras: 가중치 로딩 시 HDF5 Shape Bomb을 통한 서비스 거부Denial of Service -orange?style=for-the-badge -brightgreen?style=for-the-badge 개요...

ExWA

ExWa WhatsApp для CLI с API ExWa — это простой инструмент, написанный на PHP, который позволяет использовать WhatsApp в версии для CLI с помощью API сайта rapiwha.com. Установка : $ git clone https://github.com/dalpan/ExWa $ cd ExWa $ php exwa.php Использование : Сначала зарегистрируйтесь на...

log4j-exploit-fork-bomb

log4j-exploit-with-fork-bomb 💣💥💀 Proof of Concept: пример запуска fork-бомбы на удаленном сервере благодаря уязвимости CVE-2021-44228 1. Создаем LDAP сервер атакующего модуль server, который будет выдавать представления строк и кода модуль payload 2. Создаем пример жертвы модуль victim и передаем...

artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address

A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray method uses ObjectInputStream.readObject to deserialize CompositeData from Base64-encoded serialized objects in management message bodies sent to the activemq.management address. While the deserialization is protected by an...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)

A flaw was found in the Netty netty-codec-http component. A remote attacker can send HTTP requests containing highly compressed data. The HTTP decoder in netty-codec-http fails to properly limit the decompression of this content, causing the system to consume excessive memory. This can lead to...

artemis-core-client: activemq-artemis: Unsafe deserialization via JsonUtil CompositeData on management address

A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray method uses ObjectInputStream.readObject to deserialize CompositeData from Base64-encoded serialized objects in management message bodies sent to the activemq.management address. While the deserialization is protected by an...

tar: node-tar: Denial of Service via crafted gzip bomb

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on t...

CVE-2026-46387 Suricata http2: decompression bomb can cause denial of service in Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

CVE-2026-46387 Suricata http2: decompression bomb can cause denial of service in Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

CVE-2026-46387 Suricata http2: decompression bomb can cause denial of service in Suricata

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

CVE-2026-46387

Suricata , a network IDS/IPS/NSM engine, is affected by a decompression bomb vulnerability in its HTTP/2 decompression path . Prior to versions 7.0.16 and 8.0.5 , a crafted HTTP/2 DATA payload using a high compression ratio (gzip, deflate, or brotli) could cause Suricata to allocate excessive mem...

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 Sliver C2의 HTTPS 리스너에 대한 서비스 거부DoS 익스플로잇입니다. 세션별 PNG 인코딩 nonce를 무차별 대입brute-force하여 서버 메모리를 고갈시키는 압축 해제 폭탄decompression bomb을 전달합니다. GHSA-663m-7x7m-g4fw로 공개되었습니다. 요약 Sliver의 HTTPS C2 채널은 메시지를 PNG 이미지 내부에 래핑합니다. 각 세션에는 1, 65537 범위의 무작위 nonce가 할당되며, 서버는 ?n= 쿼리 매개변수가 세션의...

CVE-2026-57822

A flaw was found in Apache ActiveMQ Artemis. The JsonUtil.fromJsonArray method uses ObjectInputStream.readObject to deserialize CompositeData from Base64-encoded serialized objects in management message bodies sent to the activemq.management address. While the deserialization is protected by an...

CVE-2026-31899

CVE-2026-31899: CairoSVG の再帰的 要素増幅による指数関数的 DoS キーワード: CVE-2026-31899、CairoSVG、指数関数的 DoS、SVG 爆弾、再帰的 use 要素、サービス妨害、XML 増幅、Python SVG の脆弱性、CWE-400、制御不能なリソース消費、billion laughs SVG 目次 概要 脆弱性の詳細 技術的分析 概念実証 影響 対策...

undici: undici: Denial of Service via unbounded decompression of compressed responses

A flaw was found in undici. The decompress interceptor in undici processes compressed response bodies based on the untrusted Content-Encoding header. A remote attacker can exploit this by sending a small, specially crafted compressed payload, known as a 'compression bomb,' which expands...

wheelaudit

wheelaudit Python Wheel 파일 보안 스캐너 — 설치 전에 .whl 파일의 보안 문제를 스캔합니다. 최근 Python wheel 처리에서 발생한 CVE에서 영감을 받았습니다: CVE-2026-24049 : wheel 압축 해제 시 경로 탐색으로 시스템 파일 권한 조작 가능 CVE-2026-1703 : pip가 wheel 아카이브를 설치할 때 발생하는 경로 탐색 Google GHSA-w97x-xxj5-gpjx : Python wheel의 Zip 파서 차등 취약점 의존성 제로. 단일 파일. Python 3.9+. ...