DHEater

DHEater DHEater is the proof-of-concept implementation of the DHEat attack CVE-2002-20001. It saturates a server's CPU by enforcing Diffie-Hellman ephemeral DHE or elliptic-curve Diffie-Hellman ephemeral ECDHE key exchange over both TLS and SSH. For further information about the attack visit the...

Envoy-CPU-Exhaustion-Vulnerability-PoC

PoC de Vulnerabilidad de Agotamiento de CPU de Envoy Este repositorio contiene un script Python de prueba de concepto PoC para demostrar la vulnerabilidad de agotamiento de CPU en Envoy causada por una avalancha de tramas CONTINUATION. Autor: blackmagic 2024 Descripción Envoy es un proxy de borde...

POC-CVE-2025-48988-CVE-2025-48976

CVE-2025-48988 & CVE-2025-48976 Acerca de Este proyecto ejecuta un endpoint simple de carga de archivos con Tomcat 10.1.41 y un Jakarta Servlet. El exploit ejecuta, por defecto, 1000 solicitudes multipart paralelizadas con 1000 partes y 50 encabezados por parte, desde 50 trabajadores. Ejecutar Po...

phpstress

phpstress Prueba de concepto de Night Lion Security de denegación de servicio / probador de estrés para sitios web PHP que se ejecutan en sistemas Apache y NGINX PHP-FPM y PHP-CGI Usando una conexión estándar de cable/DSL, este ataque puede inundar la CPU y RAM de un servidor web Linux usando...

EUVD-2026-57759

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary...

openssh_dos

Debido a que los servidores OpenSSH no restringen la longitud de la contraseña de inicio de sesión, puedes provocar que estos servidores se bloqueen enviando contraseñas muy largas que utilizan grandes cantidades de la CPU del servidor para calcular su hash. Esta vulnerabilidad se conoce como...

Wordpress-DOS-Attack-CVE-2018-6389

Wordpress-DOS-Attack-CVE-2018-6389 El archivo load-scripts.php, cuyo propósito es recuperar varios paquetes de JavaScript a través de una sola solicitud. $ chmod +x Execute.sh $ ./Execute.sh ¡Cómo funciona! El problema radica en el archivo load-scripts.php, cuyo propósito es recuperar varios...

GHSA-35MR-4567-66VG Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution

Affected file dulwich/pack.py Method: Pack.resolveobject Description / Summary A High-severity Denial of Service DoS vulnerability exists in the Pack.resolveobject method. When resolving an OFSDELTA object, the resolver calculates the base offset using baseoffset = objoffset - deltaoffset. If a...

CVE-2026-104861

A flaw was found in probe-image-size. An unauthenticated remote attacker can exploit this vulnerability to cause a Denial of Service DoS by supplying specially crafted Scalable Vector Graphics SVG input. Due to inefficient pattern matching and input handling during SVG parsing, processing unclose...

CVE-2026-104845

The Seroval library is vulnerable to a Denial of Service (DoS) condition in versions prior to 1.6.3 . The deserializeTypedArray function within fromJSON and fromCrossJSON fails to bound the serialized element count when trusting a deserialized source value as an ArrayBuffer. An attacker can provi...

CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...

CVE-2026-104844 PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion

PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters are not tokenizer word delimiters. The...

CVE-2026-63578

Allocation of resources without limits in password-based private-key decryption PbeUtilities.GenerateCipherParameters in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply an encrypted private key, such as a PKCS8 EncryptedPrivateKeyInfo or "ENCRYPTED PRIVAT...

CVE-2026-63572

Allocation of resources without limits in PKCS12 keystore loading Pkcs12Store.Load in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS12 PFX file to cause a denial of service through CPU exhaustion via an iteration count close to 2^31 in the file's...

CVE-2026-63575

Loop with unreachable exit condition in the PKCS12 key derivation Pkcs12ParametersGenerator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can supply a PKCS12 PFX file, or a PKCS8 encrypted private key that uses a PKCS12 password-based encryption algorithm, to...

CVE-2026-103604

Inefficient algorithmic complexity in X.509 distinguished name string conversion X509Name.ToString and IetfUtilities.ValueToString in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a...

CVE-2026-63568

Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier PKMacBuilder in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a CMP message or CRMF certifica...

EUVD-2026-91234

Inefficient algorithmic complexity in X.509 distinguished name string conversion X509Name.ToString and IetfUtilities.ValueToString in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a...

CVE-2026-103604 Quadratic-time escaping when converting X.509 distinguished names to strings

Inefficient algorithmic complexity in X.509 distinguished name string conversion X509Name.ToString and IetfUtilities.ValueToString in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a...

CVE-2026-103604 Quadratic-time escaping when converting X.509 distinguished names to strings

Inefficient algorithmic complexity in X.509 distinguished name string conversion X509Name.ToString and IetfUtilities.ValueToString in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaustion via a...