CVE-2026-23869

CVE-2026-23869 - 概念実証（PoC） 説明 このリポジトリには、React Server Components 19.2.5 より前のバージョンに影響する脆弱性 CVE-2026-23869 の概念実証（PoC）が含まれています。 この脆弱性により、攻撃者は認証なしの単一リクエストでサーバーに多大な CPU 負荷を発生させ、数分間にわたりサーバーを応答不能にすることができます。 https://www.imperva.com/blog/react2dos-cve-2026-23869-when-the-flight-protocol-crashes-at-takeoff/...

CVE-2023-29409

CVE-2023-29409 root@kitploit: $ openssl genrsa -out ca-key.pem 2048 $ openssl req -x509 -new -nodes -key ca-key.pem -sha256 -days 100000 -out ca.pem \ -addext 'keyUsage=keyCertSign' \ -subj '/CN=Root CA' $ go run main.go server in the background $ go run main.go client causes high cpu load on...

Astra Linux – Vulnerability in Qemu

An infinite loop flaw was discovered in the e1000 NIC emulator of QEMU. This issue occurs when processing transmit tx descriptors in processtxdesc, especially if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in...

DEBIAN-CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

UBUNTU-CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

UBUNTU-CVE-2026-23930

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

CVE-2026-23934

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

EUVD-2026-60735

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

CVE-2026-23930 Frontend DoS via the popup.testtriggerexpr action

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

EUVD-2026-55630

Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff...

CVE-2026-47249

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.18, the P2P resolver request handling logic is vulnerable to hash-array amplification. A connected peer can send a compressed RequestDataTypeHashArrayType direct request that is only 442 bytes on the wire but expan...

CVE-2026-47249

CVE-2026-47249 affects Klever-Go KVM (Go implementation of Klever) prior to v1.7.18. The issue is in P2P resolver request handling where a compressed RequestDataType_HashArrayType direct request (wire size ~442 bytes) can expand into about 200,000 decoded hash entries inside the resolver path. Th...

brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity

A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the expand function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-lo...

CVE-2026-47180

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming.decodelabelsatoffset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.init, causing...

CVE-2026-47736

Summary: CVE-2026-47736 affects the Puma Ruby/Rack web server when PROXY protocol v1 is enabled. In affected releases (5.5.0 up to 7.2.1 and 8.0.2), Puma reads incoming bytes into an internal buffer while waiting for CRLF to detect a PROXY v1 line, allowing an attacker to send data without CRLF a...

PT-2026-60044

Impact AsyncListener.handle query or defer retained every truncated TC-bit incoming query in self. deferredaddr and armed a per-addr timer in self. timersaddr that flushed the reassembled query within 500 ms RFC 6762 §18.5. Neither the per-addr list nor the number of distinct addr keys was capped...