EUVD-2026-74845

GitPython: Denial of Service via catastrophic backtracking ReDoS in Actor.nameemailregex — commit author/committer field parsing...

GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsing

Summary GitPython's Actor.nameemailregex regular expression git/util.py, line 863 is vulnerable to catastrophic backtracking ReDoS — Regular Expression Denial of Service. When GitPython parses the author or committer header of a git commit object that contains a long string with an unterminated ,...

Envoy-CPU-Exhaustion-Vulnerability-PoC

PoC de Vulnerabilidad de Agotamiento de CPU de Envoy Este repositorio contiene un script Python de prueba de concepto PoC para demostrar la vulnerabilidad de agotamiento de CPU en Envoy causada por una avalancha de tramas CONTINUATION. Autor: blackmagic 2024 Descripción Envoy es un proxy de borde...

golang-CVE-2023-44487

Pruebas de Golang CVE-2023-44487 Este repositorio contiene recursos y resultados de pruebas para el CVE-2023-44487. Utiliza una versión modificada de https://github.com/secengjeff/rapidresetclient para probar varias configuraciones de servidores Golang. Pruebas contra un servidor normal go run...

phpstress

phpstress Prueba de concepto de Night Lion Security de denegación de servicio / probador de estrés para sitios web PHP que se ejecutan en sistemas Apache y NGINX PHP-FPM y PHP-CGI Usando una conexión estándar de cable/DSL, este ataque puede inundar la CPU y RAM de un servidor web Linux usando...

openssh_dos

Debido a que los servidores OpenSSH no restringen la longitud de la contraseña de inicio de sesión, puedes provocar que estos servidores se bloqueen enviando contraseñas muy largas que utilizan grandes cantidades de la CPU del servidor para calcular su hash. Esta vulnerabilidad se conoce como...

OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full

Summary A BatchingProcessor in go.opentelemetry.io/otel/sdk/log can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries an...

CVE-2025-26466-msf

CVE-2025-26466 módulo de Metasploit OpenSSH versiones 9.5p1 a 9.9p1 es vulnerable a un ataque DoS por agotamiento de memoria y CPU mediante el envío repetido de paquetes SSH2MSGPING tipo 192. Esto ocurre antes de la autenticación y puede provocar un bloqueo del servidor debido a un manejo...

POC-CVE-2025-48988-CVE-2025-48976

CVE-2025-48988 & CVE-2025-48976 Acerca de Este proyecto ejecuta un endpoint simple de carga de archivos con Tomcat 10.1.41 y un Jakarta Servlet. El exploit ejecuta, por defecto, 1000 solicitudes multipart paralelizadas con 1000 partes y 50 encabezados por parte, desde 50 trabajadores. Ejecutar Po...

Wordpress-DOS-Attack-CVE-2018-6389

Wordpress-DOS-Attack-CVE-2018-6389 Load-scripts.php file, which purpose is to retrieve several JavaScript packages through one single request. $ chmod +x Execute.sh $ ./Execute.sh How it Works! The problem lies upon the load-scripts.php file, which purpose is to retrieve several Javascript packag...

CVE-2026-102270

A flaw was found in PyJWT. An attacker can cause a Denial of Service DoS by providing crafted certificate-like input containing repeated start markers without matching end markers. This malformed input triggers excessive regular expression backtracking during validation in the ispemformat functio...

CVE-2026-102270

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT ispemformat is affected because lazy PEM regular expression backtracks extensively. This occurs when a certificate-like input contains repeated BEGIN markers without a matching END marker. As a result, ispemforma...

EUVD-2026-76142

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS...

CVE-2022-0778

CVE-2022-0778 Descripción Nos referimos al concepto de drago-96 y luego reescribimos un PoC basado en el formato P12 y PEM. Puede usarlo para verificar las vulnerabilidades CVE-2022-0778, es decir, un certificado SSL peligroso sin contraseña privada, déjelo vacío. Si el dispositivo está afectado,...

Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in Immutable.js

Summary IBM DataPower Gateway affected by multiple CVEs in Immutable.js Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Listset, ListsetSize, ListsetIn, ListupdateIn, and the functional set, setIn,...

CVE-2026-94287

The libXpm library (versions before 3.5.19 ) is vulnerable to a denial of service due to an unsigned underflow in its write path. A local attacker can exploit this flaw to trigger unbounded CPU usage and memory exhaustion . No specific exploit information or in-the-wild exploitation details are p...

Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable with Jackson Databind library

Summary Multiple vulnerabilities related to Jackson Databind library were addressed for IBM Engineering Systems Design Rhapsody. Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar...

CVE-2026-100648

A flaw was found in vllm. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by bypassing file size restrictions during multimodal chat audio processing. By submitting requests with oversized audio files, an attacker can force the server to allocate...

CVE-2026-100647 vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...

CVE-2026-100647 vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cachesalt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the single EngineCore scheduler thread. Unauthenticated attackers can send HTTP...