135145 matches found
netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec
A flaw was found in Netty. A remote attacker can exploit a vulnerability in the SpdyHttpDecoder handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated SYNSTREAM frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This...
Important: Red Hat Security Advisory: Apicurio Registry (container images) release and security update [ 3.3.3 GA ]
An update to the images for Red Hat build of Apicurio Registry is now available from the Red Hat Container Catalog. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of...
CVE-2026-49975
CVE-2026-49975 HTTP/2 Bomb PoC HTTP/2 Remote Denial of Service Vulnerability Replication Tool Vulnerability Overview CVE-2026-49975 is an HTTP/2 denial of service vulnerability affecting major web servers. The vulnerability was discovered by security company Calif using OpenAI Codex in early June...
CVE-2026-44789-n8n-PrototypePollution-RCE
CVE-2026-44789 — Contaminación de prototipos en la paginación del nodo de solicitud HTTP de n8n → RCE Un creador de flujos de trabajo autenticado de n8n La advertencia pública solo indica que la contaminación "combinada con otras técnicas podría llevar a RCE" — no divulga un gadget. Este...
CVE-2026-42530
CVE-2026-42530 Scanner para CVE-2026-42530, un uso después de liberar en el módulo HTTP/3 de nginx. Afectado: nginx 1.31.0, 1.31.1 Corregido: nginx 1.31.2 Uso pip install aioquic python3 scannerCVE-2026-42530.py port python3 scannerCVE-2026-42530.py --file hosts.txt Cómo funciona Abre dos flujos...
CVE-2026-23744
CVE-2026-23744 Descripción MCPJam inspector es una plataforma de desarrollo local-first para servidores MCP. Las versiones =1.4.2 son vulnerables a una vulnerabilidad de ejecución remota de código, que permite a un atacante enviar una solicitud HTTP manipulada que desencadena la instalación de un...
CVE-2026-49975
CVE-2026-49975 HTTP/2 Bomb Exploit Tool Author : polar bear Version : 2.1 Applicable Vulnerability : CVE-2026-49975 HTTP/2 Protocol Memory Bomb 📖 Vulnerability Principle CVE-2026-49975 is a memory exhaustion vulnerability in the HTTP/2 protocol implementation. The attack chain consists of two key...
CVE-2026-33186
CVE-2026-33186 gRPC-Go RBAC Authorization Policy Bypass via Missing :path Slash Auth Bypass Description The authz package in google.golang.org/grpc implements SDK-level RBAC authorization using deny and allow rules matched against the :path pseudo-header. The HTTP/2 server transport stores the ra...
CVE-2026-40859
camel-netty-http / camel-vertx-http HTTP-Response Unsafe Deserialization Reproducer CVE-2026-40859 This project demonstrates a Java deserialization vulnerability in Apache Camel's camel-netty-http and camel-vertx-http components, tracked as CVE-2026-40859. When a producer endpoint is configured...
rapid-reset-check
Rapid Reset Check rapid-reset-check is a small Go CLI for quickly inventorying HTTPS endpoints that expose HTTP/2 and therefore need a CVE-2023-44487 mitigation review. The scanner is deliberately non-exploitative. It resolves each target, opens a certificate-verified TLS connection, offers h2 an...
CVE-2025-5349-Scanner
CVE-2025-5349 Vulnerability Scanner Usage python3 scanner.py 10.0.0.5 10.0.0.6 -p 80 python3 scanner.py netscaler.local --https -p 443...
CVE-2026-46588
camel-couchdb CouchDb Header Injection Reproducer CVE-2026-46588 Este proyecto demuestra una inyección de cabeceras de mensaje en el componente camel-couchdb de Apache Camel, registrada como CVE-2026-46588. El componente lee varias cabeceras de Exchange para controlar su comportamiento —...
CVE-2021-41773h
CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 CVE-2021-41773 Info A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the expected document...
Oracle WebLogic Server Administration Console - Remote Code Execution
The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent: Web Services versions 0.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0 contain an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server. id:...
Oracle Fusion Middleware Weblogic Server - Remote OS Command Execution
The Oracle WebLogic Server component of Oracle Fusion Middleware Web Services versions 10.3.6.0, 12.1.3.0, 12.2.1.0, 12.2.1.1 and 12.2.1.2 is susceptible to a difficult to exploit vulnerability that could allow unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic...
CVE-2021-41773-PoC
CVE-2021-41773 Vulnerabilidad de path traversal y divulgación de archivos en Apache HTTP Server 2.4.49 Este script prueba Apache HTTP Server 2.4.49 Uso: CVE-2021-41773.py opciones Solo para una IP: python CVE-2021-41773.py IPaddress Opción -f Para lista de IPs en un archivo Ejemplo: python...
CVE-2024-27316
CVE-2024-27316 Decidí llamar a esta vulnerabilidad específicamente "CVE-2024-27316" ya que la he probado contra esta vulnerabilidad. El fallo subyacente afecta a otros CVE, así que pensé en mencionarlos con la esperanza de que otros puedan probar y modificar este PoC : Este PoC actualmente solo...
CVE-2026-42530
🛡️ CVE-2026-42530 - Vulnerabilidad de Use-After-Free en NGINX HTTP/3 QUIC Use-After-Free de Alta Gravedad en NGINX HTTP/3 QUIC ⚠️ Vulnerabilidad del Flujo del Codificador QPACK 🔍 Resumen CVE-2026-42530 es una vulnerabilidad de use-after-free en el módulo ngxhttpv3module de NGINX. Un atacante remoto...
