EEF-CVE-2026-82729 Quadratic chunk-size parsing in Mint.HTTP1.Parse allows CPU-exhaustion DoS

Summary Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause a denial of service. parsehexprefix/2 in lib/mint/http1/parse.ex folds each hex digit of a chunked response's chunk-size field into an...

silifuzz

SiliFuzz - 通过代理对 CPU 进行模糊测试 什么是 SiliFuzz SiliFuzz 是一种通过模糊测试软件代理（如 CPU 模拟器或反汇编器）来发现 CPU 缺陷的系统，然后大规模地在真实 CPU 上执行累积的测试输入（称为 corpus ）。SiliFuzz 仍在开发中，详情请参阅论文。 术语 软件模糊测试与覆盖率 模糊测试是一种使用大量即时生成的测试输入来测试目标（应用程序或 API）的技术。其目标是让这些输入尽可能有趣且多样化，以触发极端情况。换句话说，模糊测试旨在最大化组合代码覆盖率。 代码覆盖率 可能有不同的含义，例如执行了哪些基本块，或者程序采用了哪些路径。...

cve-2025-26466-openssh-poc

CVE-2025-26466 OpenSSH SSH2MSGPING DoS PoC 免责声明： 此代码仅供教学目的 和授权安全测试使用。未经授权攻击他人系统属于违法行为。 漏洞 CVE-2025-26466 是 OpenSSH 中的一个预认证拒绝服务（DoS）漏洞，可在密钥交换完成前使 SSH 服务器过载。 技术细节 受影响版本： OpenSSH 9.9p2 之前的版本 类型： 预认证 DoS / 内存泄漏 利用方式： 在加密连接建立之前处理 SSH2MSGPING 数据包 服务器在初始握手期间就接受 SSH2MSGPING 数据包（消息类型 192），而无需存在已认证的连接。这会导致...

prefetch-tool

Windows KASLR 预取工具 一个用于在 Windows 11 上绕过 KASLR（内核 ASLR）的概念验证工具。灵感来自针对 Linux 的 EntryBleed。 该工具是作为针对 Windows 11 24H2 的漏洞利用的一部分而开发的。我完全不是侧信道方面的专家，因此这对我来说是一个全新的领域，代码也写得非常粗糙 😳 非常欢迎帮助提高不同 CPU 类型下的可靠性。 我只用手头的机器做了有限的测试。我发现我实现的技术在现代 Intel CPU 上相当可靠，但在 AMD 上则差很多。 CPU 支持 CPU| 状态 ---|--- Intel| 🟢 可靠 AMD| 🟡 不稳...

bochscpu-python

bochscpu-python Python 绑定，用于 @yrp 的 BochsCPU，通过 FFI 轻松且精确地模拟 x86 代码。 安装 bochscpu-python 仅需要 Python 3.8 或更高版本的环境。 通过 PyPI 安装（推荐） 到目前为止，最简单的上手方式是使用 PyPI 上的稳定打包版本。 root@kitploit: python -m pip install bochscpu-python 通过生成的构建产物 从仓库的 GitHub Actions 标签页下载最新的可用构建产物。解压 ZIP 文件，安装 wheel 文件夹中的 .whl 文件。...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: ruby (UTSA-2026-106198)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106198 advisory. The attack vector is a potential Denial of Service DoS. The vulnerability is caused by an insufficient check on the length of a decompressed domain name within a DNS...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

Stryker

Stryker Multi-purpose proof-of-concept tool based on CPU-Z CVE-2017-15303 System Requirements x64 Windows 7/8/8.1/10; Stryker designed only for x64 Windows; Administrative privilege is required. Features Driver Signature Enforcement Overrider similar to DSEFIx; Protected Processes Hijacking via...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing

A flaw was found in js-yaml, a JavaScript YAML parser. An attacker can exploit this by providing a specially crafted YAML document that causes the parser to perform excessive processing when handling merge keys with empty sources. This can lead to prolonged CPU consumption, effectively causing a...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header

A flaw was found in the Golang MIME Multipurpose Internet Mail Extensions package. A remote attacker could exploit this vulnerability by sending a maliciously-crafted MIME header containing many invalid encoded-words. This could lead to excessive CPU consumption, resulting in a Denial of Service...

poc-CVE-2025-38352

🚀 poc-CVE-2025-38352 - 安全工具的简易下载 📥 立即下载 📖 概述 此应用程序是CVE-2025-38352的概念验证。它展示了Linux内核POSIX CPU定时器实现中的一个漏洞。2025年9月的Android公告指出，此漏洞已在有限环境中被用于针对性利用。 🖥️ 系统要求 要顺利运行此应用程序，请确保您的系统满足以下要求： 操作系统：Linux（任何较新的发行版） 内核版本：已安装最新更新 额外工具：基本的终端命令知识 🚀 快速入门 请按照以下步骤进行设置： 1. 下载软件 访问此页面下载应用程序。 2. 找到下载的文件...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling

A vulnerability was found in the Linux Kernel. This issue affects performance monitoring on the s390 architecture during specific CPU hotplug scenarios...

kernel: s390/cpum_sf: Handle CPU hotplug remove during sampling

A vulnerability was found in the Linux Kernel. This issue affects performance monitoring on the s390 architecture during specific CPU hotplug scenarios...

CVE-2026-23869

CVE-2026-23869 - Proof of Concept PoC Description This repository contains a Proof of Concept PoC for CVE-2026-23869 , a vulnerability affecting React Server Components before 19.2.5. The vulnerability allows an attacker to cause a significant CPU charge on the server making it non responsive for...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS 通过 React Flight 协议实现未认证远程拒绝服务 服务器组件 Map 反序列化中的二次方 CPU 耗尽 概述 • 工作原理 • 工具 • 安装 • 用法 • Nuclei • 修复 • 免责声明 漏洞概述 字段| 详情 ---|--- CVE ID| CVE-2026-23869 别名| React2DoS CVSS 评分| 7.5（高危） CVSS 向量| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE| CWE-400（未受控的资源消耗） 类型| 未认证远程拒绝服务...

CVE-2026-6042-PoC

CVE-2026-6042：musl libc iconv 中的算法复杂度拒绝服务（DoS） musl 的 iconv GB18030 4字节解码器中的间隙跳过循环（gap-skipping loops）允许少量精心构造的输入消耗不成比例的CPU时间。一个40 KB的对抗性载荷可以使单个CPU核心满载运行超过40分钟。 安全公告 ：https://www.openwall.com/lists/oss-security/2026/04/09/19 NVD ：https://nvd.nist.gov/vuln/detail/CVE-2026-6042...

Next.js Framework 15.5.x < 15.5.21 / 16.x < 16.2.11 Image Optimization API DoS (GHSA-q8wf-6r8g-63ch)

The Next.js Framework on the remote host is affected by a denial of service vulnerability: - When self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if configured not enabled by default. If those images contain malicious content, the...