ghostsplice

GhostSplice: фрагментация доверия между каналами PoC-атака PoC-код для GhostSplice — атаки от ASSET Research Group. Полное описание: «ИИ отказался красть секреты. Поэтому мы дали ему форму». Суть простыми словами ИИ-ассистенты для программирования, такие как Cursor, VS Code с GitHub Copilot, Code...

Fireaway

FireAway — Инструмент для обхода межсетевых экранов нового поколения v0.2 Fireaway — это инструмент для аудита, обхода и экфильтрации данных через правила инспекции уровня 7/AppID на межсетевых экранах нового поколения NGFW, а также через другие механизмы защиты с глубокой инспекцией пакетов, так...

killasa

killasa Test de vulnérabilité pour CVE-2016-1287 longueur de fragment IKE invalide dans Cisco ASA Négocie une SA IKEv2 avec la fragmentation Cisco activée, puis envoie deux fragments IKE, dont l'un a une longueur invalide de 1 octet...

ipv6_frag_escape

IPV6FRAGESCAPE — Linux IPv6 조각화 컨테이너 탈출 추적 사이트 IPV6FRAGESCAPE 패치 상태 추적기의 소스: Linux 커널의 IPv6 조각화 컨테이너 탈출에 대한 수정을 어떤 배포판이 제공했는지 기록하는 단일 페이지 사이트입니다. 정보가 있는 곳 버그에 관한 모든 정보 — CVE ID, 영향받는 버전 및 수정된 버전, 업스트림 수정 커밋, 발견 및 공개 크레딧, 그리고 배포판별 최종 패치 상태 — 는 이 README가 아닌 추적기 페이지에 있습니다: 렌더링된 페이지:...

ipv6_frag_escape

IPV6FRAGESCAPE CentOS / RHEL 10용 비특권 컨테이너 / jail 탈출 proof of concept입니다. 현재는 수정된 ip6appenddata의 IPv6 단편화 버그상류 커밋 38becddc로 패치됨, CVE 없음를 이용하며, 패킷 자체의 head 객체 끝에 있는 skbsharedinfo로의 in-slab 선형 오버플로in-slab linear overflow입니다. 이 README는 익스플로잇 체인만 다룹니다. 트리거는 다루지 않습니다. 범위 대상: CentOS / RHEL 10 커널 6.12.x,...

CVE-2026-74627

A flaw was found in the Linux kernel's net: devmem component. This vulnerability occurs when netiov and page-backed fragments are improperly mixed within a single skb socket buffer in the zerocopyfillskbfromdevmem function. This improper handling can lead to a system crash, resulting in a Denial ...

fragattacks

FragAttacks: Fragmentation & Aggregation Attacks 1. Введение Этот репозиторий содержит инструмент FragAttacks. С его помощью можно проверять Wi-Fi-клиенты и точки доступа на наличие fr агментационных и ag регационных атак. Эти уязвимости затрагивают все защищённые Wi-Fi-сети. Дополнительную...

CVE-2026-74474

A flaw was found in the Linux kernel's vxlan module. This vulnerability arises from the incorrect handling of network packet headers during data transmission. Specifically, certain functions within the vxlan module fail to properly account for the initial part of the network packet, known as the...

librenswan: IKEv2 Denial of Service via malformed fragmentation

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...

CVE-2026-63495

Libevent (event notification library) versions 2.2.0-alpha-dev through 2.2.2-alpha contain an unbounded memory accumulation vulnerability in its WebSocket server (ws.c). The evws->incomplete_frames buffer accumulates fragmented frames without enforcing a total message-size limit. An unauthenti...

EUVD-2026-63503

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws-incompleteframes without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket...

CVE-2026-63383

In libevent prior to 2.1.13 and 2.2.2-alpha, decode_tag_internal() in event_tagging.c requests at most five bytes via evbuffer_pullup but iterates over the full logical buffer length. A fragmented evbuffer holding a six-byte malformed tag can advance past the pullup window, causing an out-of-boun...

Linux Distros Unpatched Vulnerability : CVE-2026-75596

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, the default io.netty.handler.ssl.SniHandler...

CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

CVE-2026-75595

Netty (asynchronous, event-driven network framework) is affected by an SNI routing bypass in io.netty.handler.ssl.SslClientHelloHandler#decode . The method checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records triggers an ...

CVE-2026-72250

A flaw was found in the Linux kernel's nfconntrackreasm module, specifically within the IPv6 defragmentation process. An attacker could exploit this by sending specially crafted IPv6 fragmented packets. The nfctfrag6reasm function incorrectly adjusts the macheader offset, causing the system to...

CVE-2026-72230

A flaw was found in the batman-adv Better Approach To Mobile Ad-hoc Networking - Advanced fragmentation module of the Linux kernel. The batadvfragsendpacket function, responsible for sending fragmented packets, does not properly free allocated memory when a packet is deemed unfragmentable due to ...

librenswan: IKEv2 Denial of Service via malformed fragmentation

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...

CVE-2026-72230

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadvfragsendpacket assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an error...

CVE-2026-72057

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb control buffe...