Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification

Summary The 50-megapixel decode guard exists only on the task-attachment preview path. Avatar and project-background uploads decode uploaded images with no pixel cap. Worse, the avatar resize fixes the output height at 1024 and derives the width from the aspect ratio, so a tiny extreme-aspect-rat...

CVE-2026-107833 OWASP Coraza WAF: Unbounded recursion in JSON response body processor causes CPU exhaustion

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, ProcessResponse in internal/bodyprocessors/json.go passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can...

CVE-2026-107833

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) contains an unbounded recursion vulnerability in the ProcessResponse function located in internal/bodyprocessors/json.go. The root cause is that the ignoreJSONRecursionLimit value of -1 is passed to readJSON, while the recursive guard o...

CVE-2026-86463

The Apache CXF FIQL query parser is vulnerable to a Denial of Service condition due to an issue in how it searches for operators within query expressions. When the parser encounters a long string without an operator, it may attempt numerous combinations, leading to excessive CPU consumption . An ...

EUVD-2026-95698

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

CVE-2026-86463 Apache CXF: FIQL Query Parser Denial of Service

Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions. The search pattern can get stuck trying many combinations when it encounters a long string without an operator, causing the parser to consume excessive CPU time. An attacker can send a crafte...

Envoy-CPU-Exhaustion-Vulnerability-PoC

Envoy CPU थकावट भेद्यता PoC इस रिपॉजिटरी में Envoy में CPU थकावट भेद्यता को प्रदर्शित करने के लिए एक प्रूफ-ऑफ-कॉन्सेप्ट PoC Python स्क्रिप्ट शामिल है, जो CONTINUATION फ्रेम्स की बाढ़ के कारण होती है। लेखक: blackmagic 2024 विवरण Envoy एक क्लाउड-नेटिव, ओपन-सोर्स एज और सर्विस प्रॉक्सी है जो आधुनिक...

Wordpress-DOS-Attack-CVE-2018-6389

Wordpress-DOS-Attack-CVE-2018-6389 ملف Load-scripts.php، الذي الغرض منه جلب عدة حزم JavaScript من خلال طلب واحد. $ chmod +x Execute.sh $ ./Execute.sh كيف يعمل! تكمن المشكلة في ملف load-scripts.php، الذي الغرض منه جلب عدة حزم JavaScript في طلب واحد، مثل bootstrap وjquery وjqueryUI، وغيرها. من المم...

openssh_dos

Puisque les serveurs OpenSSH ne limitent pas la longueur du mot de passe de connexion, vous pouvez faire planter ces serveurs en envoyant des mots de passe très longs qui utilisent d'énormes quantités de CPU du serveur pour le hachage. Cette vulnérabilité est connue sous le nom de CVE-2016-6515...

DEBIAN-CVE-2026-78667

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

CVE-2026-78667

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

phpstress

phpstress Night Lion Security द्वारा प्रूफ़ ऑफ़ कॉन्सेप्ट डिनायल ऑफ़ सर्विस / स्ट्रेस टेस्टर, जो Apache और NGINX सिस्टम PHP-FPM और PHP-CGI पर चलने वाली PHP वेबसाइटों के लिए है। एक मानक केबल/DSL कनेक्शन का उपयोग करके, यह हमला मानक HTTP अनुरोधों का उपयोग करके Linux वेब सर्वर के CPU और RAM को भर सकत...

CVE-2026-78667

The FileServer(FS) , ServeContent , and ServeFile(FS) components are vulnerable to a CPU exhaustion issue. This occurs when parsing a Range header that contains a large number of small ranges, leading to excessive resource consumption. This vulnerability is associated with CWE-770 (Allocation of ...

GO-2026-6609 Lack of limit on size of parsed Range headers in net/http

When parsing a Range header containing a large number of small ranges, FileServerFS, ServeContent, and ServeFileFS can consume an excessive amount of CPU...

GHSA-3C6W-J9XM-8H2H Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Summary The JSON response body processor parses response bodies with no recursion limit. ProcessResponse calls readJSONss, ignoreJSONRecursionLimit, and that constant is -1. The guard in readItems only fires on == 0, so counting down from -1 -2, -3, ... never reaches it. The guard is effectively...

Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion

Summary The JSON response body processor parses response bodies with no recursion limit. ProcessResponse calls readJSONss, ignoreJSONRecursionLimit, and that constant is -1. The guard in readItems only fires on == 0, so counting down from -1 -2, -3, ... never reaches it. The guard is effectively...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS رفض الخدمة عن بُعد غير مصادق عليه عبر بروتوكول React Flight استنزاف CPU تربيعي في إلغاء تسلسل خريطة مكونات الخادم نظرة عامة • كيف يعمل • الأدوات • التثبيت • الاستخدام • Nuclei • الإصلاح • إخلاء المسؤولية نظرة عامة على الثغرة الحقل| التفاصيل ---|--- معرف CVE|...

EUVD-2026-94527

Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days...

CVE-2026-107287

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.7 and 2.52.0, the local webfetchtool and the WebFetch local fallback can consume excessive CPU and memory during HTML-to-Markdown conversion of attacker-controlled HTML...

golang-CVE-2023-44487

गोलांग CVE-2023-44487 परीक्षण इस रिपॉजिटरी में CVE-2023-44487 के लिए परीक्षण संसाधन और परिणाम शामिल हैं। यह विभिन्न गोलांग सर्वर कॉन्फ़िगरेशन के विरुद्ध परीक्षण के लिए https://github.com/secengjeff/rapidresetclient के एक संशोधित संस्करण का उपयोग करता है। एक सामान्य सर्वर के विरुद्ध परीक्षण go run...