Lucene search
+L

322 matches found

Kitploit
Kitploit
added 2026/09/15 5:55 p.m.14 views

ssh3

!NOTE SSH3 probablemente cambiará de nombre. Sigue siendo el Protocolo de Conexión SSH RFC4254 ejecutándose sobre HTTP/3 Extended Connect, pero los cambios necesarios son significativos y demasiado alejados de la filosofía de las implementaciones populares de SSH como para considerar su...

6.1AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 3:23 p.m.7 views

CVE-2026-4253-Scanner

CVE-2026-42530 — Safe-Check Scanner Non-destructive mass scanner for the NGINX HTTP/3 QUIC use-after-free Inventory which of your hosts are exposed — without ever triggering the bug. ⚠️ Disclaimer This tool is for authorized security testing only — your own infrastructure, or systems you have...

9.2CVSS7AI score0.06973EPSS
SaveExploits4References3
Kitploit
Kitploit
added 2026/09/15 2:24 p.m.5 views

HTTP3ONSTEROIDS

Table of contents Vulnerability Description Source Code Review Lab Setup Identifying the issue References Vulnerability Description HAProxy's HTTP/3 implementation fails to block a malformed HTTP header field name , and when deployed in front of a server that incorrectly process this malformed...

5.7AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/15 6:27 a.m.9 views

HTTP3-attacks

HTTP3-attacks CVE-2022-30592 Based on the work: E. Chatzoglou, V. Kouliaridis, G. Kambourakis, G. Karopoulos, and S. Gritzalis,"A hands-on gaze on HTTP/3 security through the lens of HTTP/2 and a public dataset", Computers & Security, p. 103051, 2022. The current repository serves the purpose of...

9.8CVSS8.3AI score0.03206EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/15 6:11 a.m.6 views

CVE-2026-42530

CVE-2026-42530 Scanner for CVE-2026-42530, a use-after-free in nginx's HTTP/3 module. Affected: nginx 1.31.0, 1.31.1 Fixed: nginx 1.31.2 Usage root@kitploit: pip install aioquic python3 scannerCVE-2026-42530.py port python3 scannerCVE-2026-42530.py --file hosts.txt How it works Opens two QPACK...

9.2CVSS7AI score0.03825EPSS
SaveExploits3References1
RedhatCVE
RedhatCVE
added 2026/09/15 4:48 a.m.5 views

CVE-2026-56816

A flaw was found in Netty. An unauthenticated remote attacker can exploit a vulnerability in Netty's Http3FrameCodec by sending specially crafted HTTP/3 reserved frames with excessive payload lengths. This can lead to uncontrolled memory buffering, causing memory exhaustion and a denial of servic...

7.5CVSS5.7AI score0.00522EPSS
SaveExploits1References6
Kitploit
Kitploit
added 2026/09/15 1:20 a.m.8 views

CVE-2026-42530

🛡️ CVE-2026-42530 - NGINX HTTP/3 QUIC Use-After-Free Vulnerability High-Severity Use-After-Free in NGINX HTTP/3 QUIC ⚠️ QPACK Encoder Stream Vulnerability 🔍 Overview CVE-2026-42530 is a use-after-free vulnerability in NGINX's ngxhttpv3module. A remote unauthenticated attacker can trigger it by...

9.2CVSS6.9AI score0.03825EPSS
SaveExploits3
EUVD
EUVD
added 2026/09/14 4:05 p.m.4 views

EUVD-2026-77618

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A...

5.3CVSS5.8AI score0.00469EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/14 4:05 p.m.3 views

CVE-2026-57497 webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A...

5.3CVSS5.7AI score
SaveExploits0References6
Vulnrichment
Vulnrichment
added 2026/09/14 4:05 p.m.3 views

CVE-2026-57497 webtransport-go: Memory Exhaustion Attack due to Buffering of Unknown Capsules

webtransport-go is an implementation of the WebTransport protocol. Prior to 0.11.1, Session.parseNextCapsule in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A...

5.3CVSS5.8AI score0.00469EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/09/14 10:29 a.m.6 views

CVE-2026-90678

A flaw was found in HAProxy. A remote, unauthenticated attacker can exploit a vulnerability in the HTTP/3 multiplexer when processing requests without a Content-Length header, leading to HTTP request smuggling. This occurs when HAProxy is configured with QUIC support and an HTTP/3 frontend, and...

8.9CVSS5.7AI score0.0052EPSS
SaveExploits0References6
UbuntuCve
UbuntuCve
added 2026/09/14 12:00 a.m.7 views

CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

7.5CVSS5.7AI score0.0052EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/09/14 12:00 a.m.6 views

Linux Distros Unpatched Vulnerability : CVE-2026-90678

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QU...

7.5CVSS5.6AI score0.0052EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/13 4:17 a.m.11 views

CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

7.5CVSS0.0052EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/09/13 3:37 a.m.38 views

CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

7.5CVSS0.0052EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/09/13 3:37 a.m.14 views

EUVD-2026-76943

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

7.5CVSS5.7AI score0.0052EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/13 3:37 a.m.8 views

CVE-2026-90678

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

7.5CVSS5.8AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/09/13 12:00 a.m.11 views

PT-2026-90786

An issue was discovered in HAProxy 3.3.0 through 3.4.4 and in 3.5-dev1 through 3.5-dev5. Exploitation requires an HTTP/3 frontend: HAProxy must be built with QUIC support and configured with a QUIC bind listener, and the affected traffic must reach a backend over HTTP/1.1 using chunked transfer...

7.5CVSS5.7AI score0.0052EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
added 2026/09/12 9:18 p.m.10 views

CVE-2026-88878

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. When HTTP/3 is enabled, an unauthenticated remote client can exploit a timeout bypass vulnerability by trickling request body bytes. This allows the client to hold a request open indefinitely, exhausting backend connection pool...

7.5CVSS5.7AI score0.00304EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/09/10 11:04 p.m.12 views

Traefik HTTP/3 Backend NTLM Connection Reuse

Summary Traefik's HTTP/3 request path did not initialize the connection-scoped backend transport holder that isolates connection-bound NTLM and Negotiate Kerberos authentication on the HTTP/1.1 and HTTP/2 paths. The HTTP/3 entrypoint reuses the HTTPS handler chain and reaches the same backend...

9.1CVSS5.8AI score0.00331EPSS
SaveExploits0References7Affected Software2
Rows per page
Query Builder