amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

Summary The frame-size mitigation released in amqp091-go v1.13.0 can be bypassed before connection.tune completes. A malicious or compromised AMQP peer can send only a seven-byte body-frame header containing a large attacker-controlled uint32 payload length. The client allocates a slice of that...

CVE-2026-107386

amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...

CVE-2026-107325

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

CVE-2026-107324

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

CVE-2026-107325 Application denial of service via missing BSON array length validation in MongoDB Go Driver

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

CVE-2026-107325

The MongoDB Go Driver is vulnerable to a denial of service due to improper validation of BSON array lengths. When an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array, it can trigger an out-of-bounds index and a runtime panic . An unauthenticated a...

EUVD-2026-95170

Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate or bsoncore.Array.Validate on a malformed four-byte array. An unauthenticated actor who can supply raw BSON array data to an...

CVE-2026-107324 Application denial of service via integer overflow in BSON value-length validation in MongoDB Go Driver

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

CVE-2026-107324

The MongoDB Go Driver is vulnerable to a denial of service (DoS) attack due to an integer overflow in BSON value-length validation. When an application processes a malformed BSON document, the overflow can trigger a runtime panic , potentially terminating unprotected application processes. An una...

EUVD-2026-95165

An integer overflow in BSON value-length handling in the MongoDB Go Driver can cause a runtime panic when an application validates or accesses a malformed BSON document. An unauthenticated actor who can supply BSON bytes to an affected application may terminate an unprotected application process,...

Aurora

Aurora RAT Acerca de Aurora RAT o Herramienta de Administración Remota está escrita en Go. Este proyecto se inició para aprender redes en Go y adentrarme en el campo de la seguridad. Uso Compila y ejecuta Main.go y luego ejecuta el stub en cualquier computadora que desees controlar. Stub El stub ...

CVE-2026-107386 amqp091-go: Pre-negotiation frame limit is not enforced to 4KB

amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...

CVE-2026-107386

The amqp091-go Go AMQP 0.9.1 client is vulnerable to a memory allocation issue in versions 1.13.0 through 1.14.0 . The root cause is that Connection.maxFrameSize defaults to zero for certain states, allowing a malicious AMQP peer to send a short body-frame header with a large declared payload len...

EUVD-2026-95161

amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or...

HTTPUploadExfil

HTTPUploadExfil HTTPUploadExfil es un servidor HTTP muy simple escrito en Go, útil para extraer archivos y otra información de una máquina usando HTTP. Aunque tiene muchos casos de uso, está pensado para usarse en escenarios ofensivos de bajo riesgo por ejemplo, CTFs. Piénsalo como python3 -m...

mantra

「🔑」 Acerca de Mantra La herramienta en cuestión fue creada en Go y su objetivo principal es buscar claves API en archivos JavaScript y páginas HTML. Funciona revisando el código fuente de páginas web y archivos de script en busca de cadenas que sean idénticas o similares a claves API. Estas clave...

vercel-botid

Solucionador de Vercel BotID / Cabecera "X-Is-Human" modo básico Resumen Este proyecto proporciona un solucionador basado en Golang para el desafío Vercel BotID. Utiliza go-fAST para desofuscar y luego extraer todos los valores requeridos. extremadamente rápido ⭐ Muestra tu apoyo Por favor,...

vuln-list-update

vuln-list-update Recopila información de vulnerabilidades y la guarda automáticamente en un formato analizable Datos https://github.com/aquasecurity/vuln-list/ Uso $ vuln-list-update -h Usage of vuln-list-update: -target string update target nvd, alpine, alpine-unfixed, redhat, redhat-oval, debia...

EXOCET-AV-Evasion

EXOCET - Herramienta de entrega de payloads que evade AV, indetectable Chang Tan AWS Certified Cloud Practitioner and Solutions Architect Associate [email protected] Uso actualizado de EXOCET Asegúrate de empaquetar tus payloads para evitar cualquier fuga de la clave del crypter y frustrar a...

xpfarm

XPFarm Un escáner de vulnerabilidades de código abierto que envuelve herramientas de seguridad de código abierto conocidas tras una única interfaz web. Índice Sección| Descripción ---|--- Por qué| Motivación y filosofía detrás de XPFarm Herramientas incluidas| Las 10 herramientas de código abiert...