CVE-2026-21717

CVE-2026-21717 Node.js V8 字符串哈希可预测碰撞漏洞导致拒绝服务 概述 V8 字符串哈希机制中的一个严重漏洞允许攻击者对 Node.js 应用程序造成严重的性能下降。整数字符串会被哈希为其数值，使得哈希碰撞极易被预测。通过构造恶意输入，在 V8 内部字符串表中引发大量碰撞，攻击者可以显著降低性能或造成拒绝服务。 漏洞详情 CVE ID ：CVE-2026-21717 严重性 ：高 攻击向量 ：网络 攻击复杂度 ：低 影响 ：拒绝服务（DoS） 技术描述 该漏洞源于 V8 的字符串驻留（internalization）过程。当进行 JSON...

hashes

魔法哈希 – PHP 哈希“碰撞” 使用 密码 1 注册，然后使用 密码 2 登录。如果你能成功登录，则说明存储使用指定算法对密码进行哈希，并且 PHP 使用 == 来比较它们（适用于 MD5、SHA-1 和明文）。 MD5、SHA-1、SHA-224、SHA-256 及其他 对于 MD5 、SHA-1 和 SHA-2 系列 ，它利用了众所周知的技巧（这实际上是一个有文档记载的特性，参见 PHP 类型比较表 和 浮点数）：在 PHP 中 '0e1' == '00e2' == '0'。这只是将其用于 实际 用途。任何密码都 匹配 列表中的任何其他密码。这与 整数字符串溢出为浮点数...

CVE-2023-1206-CVE-2025-40040-CVE-2024-49882

组合隐蔽信道：CVE-2023-1206 + CVE-2024-49882 概述 本项目演示了利用两个Linux内核漏洞构建的隐蔽通信信道： 组件| CVE| 目的 ---|---|--- 同步信道| CVE-2023-1206| 通过IPv6哈希碰撞时序实现时钟同步 数据信道| CVE-2024-49882| 通过大页泄漏实现跨容器数据传输 ┌─────────────────────────────────────────────────────────────────────┐ │ 非加密隐蔽信道 │...

cve-2022-22976-bcrypt-skips-salt

BCrypt 哈希检查 为协助缓解 CVE-2022-xxxx 的修复步骤，您可以使用此工具检查数据库中需要更新的哈希。 在您将应用程序 与数据库集成 后，该工具分两步工作。 为了演示，这里使用了一个内存中的示例应用程序。 在该示例应用程序上，您可以像这样运行 check 步骤： ./mvnw spring-boot:run@check 这将检查示例数据库中任何需要更新的 BCrypt 哈希。 然后，您可以像这样运行 update 步骤： ./mvnw spring-boot:run@update 这将尝试更新在示例数据库中检测到的任何易受攻击的哈希。 示例应用程序使用提供的...

collisions

TL;DR 让这两张图片发生 MD5 碰撞现在 轻而易举且即时。 ⟷ 不要玩火，不要依赖 MD5。 碰撞任意一对文件在很多年前就已可行，但每次需要数小时，且没有捷径。 本页面提供了针对特定文件格式的技巧以及预计算的碰撞前缀，使碰撞可以即时 完成。 git clone. 运行脚本。完成。 哈希碰撞与利用 作者：Ange Albertini 和 Marc Stevens。 简介 状态 攻击 相同前缀 FastColl MD5 UniColl MD5 Shattered SHA1 选择前缀碰撞 HashClash MD5 Shambles SHA1 攻击总结 利用 标准策略 JPG 自定义扫描...

CVE-2026-71855

A flaw was found in Suricata. This flaw allows a remote attacker to cause an IPv4 and IPv6 flow to be treated as identical due to a hash collision. This occurs when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align, without proper comparison of th...

K000163374: Node.js vulnerability CVE-2026-21717

Security Advisory Description A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacker can significantly...

CVE-2026-71855

The Suricata network security engine (IDS/IPS/NSM) is vulnerable to a hash collision flaw in src/flow-hash.c . Prior to versions 8.0.6 and 7.0.17 , the system can treat IPv4 and IPv6 flows as identical because it fails to compare the IP family when specific attributes—such as raw address words, p...

CVE-2026-71855 Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...

EUVD-2026-83398

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...

CVE-2026-71855 Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...

CVE-2026-57222

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-back...

DEBIAN-CVE-2026-57222

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-back...

CVE-2026-57222

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-back...

UBUNTU-CVE-2026-57222

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-back...

CVE-2026-57222 Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-back...

CVE-2026-57222

Suricata , a network IDS/IPS/NSM engine, is affected by a hash collision in src/ippair.c where IPv4 and IPv6 address pairs can collide because the IP address family is not compared before reusing IPPair-backed state. This causes incorrect detection state to be applied across IP families for xbits...

CVE-2026-57222

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-back...

EUVD-2026-83380

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-back...

CVE-2026-57222 Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-back...