EUVD-2026-113352

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding...

pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire value accumulated so far. For fixed-size fragments, CPU time grows quadratically with the encoded input size. An application that passes sufficiently large,...

GHSA-2QM8-X737-GMW5 pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding

Summary In pyasn1 through 0.6.4, decoding a constructed BIT STRING with many fragments repeatedly shifts and copies the entire value accumulated so far. For fixed-size fragments, CPU time grows quadratically with the encoded input size. An application that passes sufficiently large,...

EUVD-2026-113351

pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding...

anacrolix torrent has unbounded recursion in the bencode decoder that causes stack-overflow crash and CPU-exhaustion DoS

Summary anacrolix/torrent's bencode decoder bencode/ applies no limit on the nesting depth of nested dictionaries and lists. Two distinct denial-of-service mechanisms follow from that single root cause, both reachable from a single crafted .torrent file or from metadata obtained from a peer on a...

CVE-2026-61845

A flaw was found in crass. A remote attacker can cause a Denial of Service DoS by submitting specially crafted Cascading Style Sheets CSS inputs containing scientific notation with excessively large exponents. Because crass calculates these exponent values without proper limits, processing the...

rapidresetclient

Rapid Reset Client Rapid Reset Client is a tool for testing mitigations and exposure to CVE-2023-44487 Rapid Reset DDoS attack vector. It implements a minimal HTTP/2 client that opens a single TCP socket, negotiates TLS, ignores the certificate, and exchanges SETTINGS frames. The client then send...

CVE-2022-0778

CVE-2022-0778 Description We refer to the concept of drago-96 and then rewrite a PoC based on the P12 and PEM format. You can use it to verify the CVE-2022-0778 vulns, i.e., a dangerous SSL certificate without any private password, leave it empty. If the device is affected, it may cause the CPU o...

joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

Summary joserfc.jwe.decryptjson, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled recipients array of unbounded length and performs one full private-key decryption operation decryptcek for every recipient present in the input, with no cap on recipient...

EUVD-2026-113392

joserfc: Unbounded JWE General JSON recipients Array Leads to CPU Exhaustion DoS via Repeated RSA Private-Key Decryption...

GHSA-JPXQ-7H8P-2Q76 joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption

Summary joserfc.jwe.decryptjson, the library's public parser for JWE General JSON Serialization, accepts an attacker-controlled recipients array of unbounded length and performs one full private-key decryption operation decryptcek for every recipient present in the input, with no cap on recipient...

DHEater

DHEater DHEater is the proof-of-concept implementation of the DHEat attack CVE-2002-20001. It saturates a server's CPU by enforcing Diffie-Hellman ephemeral DHE or elliptic-curve Diffie-Hellman ephemeral ECDHE key exchange over both TLS and SSH. For further information about the attack visit the...

POC-CVE-2025-48988-CVE-2025-48976

CVE-2025-48988 & CVE-2025-48976 About This project runs a simple file upload endpoint with Tomcat 10.1.41 and a Jakarta Servlet. The exploit runs, by default, 1000 parallelized multipart requests with 1000 parts and 50 headers by part, from 50 workers. Run POC Build and run the Docker container:...

CVE-2026-87768

DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. normalizeleapseconds crosses day boundaries one day at a time, so addseconds = $n on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS...

CVE-2026-115866

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

EUVD-2026-113907

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

CVE-2026-115866

The Starlet framework for Perl (versions 0.20 before 0.33) is vulnerable to CPU exhaustion due to regular expression backtracking during the decoding of chunked request bodies. The root cause involves matching a run of hex digits followed by .* and a CRLF; specifically, a run followed by a bare L...

CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies

Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then . and a CRLF. A run followed by a bare LF and then a CRLF can never match, and the engine retrie...

EUVD-2026-113902

DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds. normalizeleapseconds crosses day boundaries one day at a time, so addseconds = $n on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS...

CVE-2026-87768

The DateTime::Lite Perl module (versions before 0.8.1 ) is vulnerable to CPU exhaustion due to inefficient algorithmic complexity (CWE-407 ). The root cause lies in the _normalize_leap_seconds function, which processes day boundaries one day at a time. When using add(seconds => $n) on an objec...