CVE-2026-33033-PoC

CVE-2026-33033 PoC 通过 base64 空白字符 CPU 放大在 DjangoMultiPartParser 中实现拒绝服务 单个 2.5 MB 的 HTTP 请求即可占用 Django worker 约 5 秒 ，相比同大小的正常请求实现了 约 2,100 倍 CPU 放大 。无需任何身份验证。 受影响版本 该漏洞已在 Django 6.0.4 安全版本（2026 年 4 月 7 日）中修复，并已向后移植到所有受支持的版本分支。 分支| 受影响| 已修复 ---|---|--- Django 6.0.x| CVE-2026-33033：MultiPartParser ...

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

Summary LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 inpu...

GHSA-GM45-99XC-R7WV yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

Summary LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 inpu...

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 input bytes...

CVE-2026-106450 yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

CVE-2026-106450 yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

CVE-2026-106450

Prior to version 1.11.4 , yawkat LZ4 Java is vulnerable to a resource exhaustion issue in the net.jpountz.lz4.LZ4FrameInputStream.readHeader() function. When processing a maximum-block-size frame header in the default concatenated-frame mode, the component allocates two new 4 MiB block buffers. A...

CVE-2026-104436 Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain...

CVE-2026-104436 Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain...

CVE-2026-104436 Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length

Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain...

NPM: devalue: Residual sparse-array CPU amplification in uneval

NPM: devalue: Residual sparse-array CPU amplification in uneval vulnerability discovered by ? in WordPress Npm devalue versions = 5.9.2...

devalue: Residual sparse-array CPU amplification in uneval

uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to...

GHSA-HX4R-W6WJ-J8FG devalue: Residual sparse-array CPU amplification in uneval

uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to...

BIT-RABBITMQ-2026-67240 RabbitMQ: ReDoS via AMQP 1.0 SQL filter LIKE wildcard

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

Rocky Linux 10.2 [CIQ] Security Update: 389-ds-base / 389-ds-base-bdb / 389-ds-base-bdb-debuginfo / etc (crlsa-2026_26456)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626456 advisory. 389-ds-base: 389-ds-base: unbounded LDAP controls count in getldapmessagecontrolsext causes CPU and heap amplification remote DoS CVE-2026-9064 Bug Fixes and...

Rocky Linux 8 [CIQ] Security Update: 389-ds-base / 389-ds-base-debuginfo / 389-ds-base-debugsource / etc (crlsa-2026_26459)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202626459 advisory. 389-ds-base: 389-ds-base: unbounded LDAP controls count in getldapmessagecontrolsext causes CPU and heap amplification remote DoS CVE-2026-9064 Tenable has extract...

PT-2026-105188

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, pattern to regex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit match limit. A pattern like % % ... %X becomes ^.?..?.....?.X$ with overlapping lazy...

GO-2026-6539 nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition

nginx ignition has ParseAcceptLanguage separator bypass that enables 75x CPU amplification via Accept-Language header in i18nMiddleware in github.com/lucasdillmann/nginx-ignition...

SUSE CVE-2026-67240

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:run is called with only capture, none - no explicit matchlimit. A pattern like %%...%X becomes ^.?..?.....?.X$ with overlapping lazy...

Linux Distros Unpatched Vulnerability : CVE-2026-67240

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, patterntoregex maps % - .? and - ., then compiles ^...$ with only unicode; re:r...