dheat_dos_attack_poc

DHeat DoS 攻撃 PoC（CVE-2002-20001） SSHサービスにおけるDHEat DoS攻撃（CVE-2002-20001）の存在をテストするためのPoC 使用方法 コマンド: python3 dheatdosattackpoc.py : テストを許可されているSSHサーバーの実際のIPアドレスまたはホスト名に置き換えます。 : SSHサービスが稼働しているターゲットポート番号。 実行手順: Ubuntu、KaliなどにPython 3をインストールする場合の基本コマンドは次のとおりです。 $ sudo apt update $ sudo apt install...

CVE-2026-77301

A flaw was found in adm-zip, a JavaScript library for handling ZIP archives. The getData function in zipEntry.js allocates memory based on the declared uncompressed size in a ZIP entry's central directory without validating this value against the actual compressed data. A remote attacker can...

CVE-2025-12767

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cause excessive resource consumption...

CVE-2026-18123

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a denial of service (DoS) condition. The root cause is the improper use of reflection when processing externally controlled input , which is classified under CWE-470 . This vulnerability impacts versions 4.0.6.0 through...

kernel: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads

A flaw was found in the net/mlx5 driver of the Linux kernel. When the driver attempts to read the MCIA register from a device advertising the mcia32dwords capability, the mlx5querymcia function can read more data than the allocated buffer can hold. This leads to a buffer overflow, which can cause...

kernel: Linux kernel Bluetooth RFCOMM: Denial of Service via use-after-free in set_termios

A flaw was found in the Linux kernel's Bluetooth RFCOMM subsystem. A race condition in the rfcommttysettermios function allows a session to be freed while it is still actively in use. This use-after-free UAF vulnerability can be exploited by a local attacker. Successful exploitation leads to a...

kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing

A flaw was found in the Linux kernel's Soft RoCE RDMA/rxe driver. An unauthenticated remote attacker can send a specially crafted UDP packet with an unknown opcode to trigger an out-of-bounds read. This vulnerability can lead to a kernel panic, effectively causing a Denial of Service DoS on the...

kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition in the hidpsessionthread can lead to a use-after-free vulnerability. This occurs when a timer is active while its deletion function is called, causing memory to be accessed after it has been freed. A local attacker could...

CVE-2018-10546

CVE-2018-10546 ユーザーは、'convert.iconv.' を使用するストリームフィルターで処理すると、対象アプリケーションが無限ループに入り、過剰な CPU リソースを消費する原因となる、特別に細工されたデータを作成できます CVE-2018-10546。 これらの脆弱性の具体的な影響は、影響を受ける関数やサービスを使用するアプリケーションによって異なります。...

CVE-2025-12767

IBM Concert versions 1.0.0 through 3.0.0 are vulnerable to a denial of service condition. A remote attacker can exploit this by providing a specially crafted regular expression that triggers excessive resource consumption . No specific remediation steps or exploit details are provided in the docu...

DEBIAN-CVE-2026-91018

lwIP Lightweight IP has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system...

CVE-2026-91018

lwIP Lightweight IP has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system...

CVE-2026-93436

A flaw was found in vLLM. A remote attacker can exploit this vulnerability by submitting specially crafted inference requests that are rejected but still cause the system to retain decode-side metadata. This improper cleanup leads to an unbounded exhaustion of decode-worker memory, resulting in a...

GHSA-GFW4-49F9-CP25 KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

Summary KubeEdge CloudHub uses the viaduct packer to decode messages received from connected peers. The packer reads a 32-bit payload length from the message header and previously allocated a buffer of that size without enforcing an upper bound. An authenticated peer that can establish a viaduct...

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub

Summary KubeEdge CloudHub uses the viaduct packer to decode messages received from connected peers. The packer reads a 32-bit payload length from the message header and previously allocated a buffer of that size without enforcing an upper bound. An authenticated peer that can establish a viaduct...

EUVD-2026-84004

KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against CloudHub...

SIPGO: DoS via unvalidated WebSocket frame length

Summary The WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS. Details WSConnection.Read allocates a buffer from the declared WebSocket frame length before reading the payload...

CVE-2026-91018 Double Free in lwIP (lightweight IP)

lwIP Lightweight IP has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system...

EUVD-2026-84864

lwIP Lightweight IP has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution on the victim system...

CVE-2026-91018

The lwIP (Lightweight IP) open-source TCP/IP stack contains a double free vulnerability . An adjacent network attacker can exploit this flaw to cause a system crash , Denial of Service (DoS) , or memory corruption . Most critically, successful exploitation could lead to arbitrary code execution ,...