CVE-2026-56848

CVE-2026-56848 NVD 説明 Node.js の HTTP/2 処理における欠陥により、nghttp2sessionmemrecv の実行中に nghttp2sessionmemsend が再入的に呼び出され、ヒープ使用後解放（heap-use-after-free）が発生する可能性があります。 この脆弱性は、Node.js 26.x、24.x、および 22.x に影響します。 注: 説明に記載されているバージョンは、上流の nodejs パッケージにのみ適用され、Alpine が配布している nodejs パッケージには適用されません。...

teamspeak3-vulnerabilities

TeamSpeak 3 サーバー - 概念実証エクスプロイト このリポジトリには、TeamSpeak 3 サーバー バージョン 3.13.7 で発見された 3 つの脆弱性 CVE-2026-4390、CVE-2026-4391、CVE-2026-4392 の概念実証コードが含まれています。 すべての発見事項は責任を持って TeamSpeak に開示され、アドバイザリ で公開されました。 ヒープユーザーアフターフリーの脆弱性 CVE-2026-4390 に関する詳細な技術解説については、私のブログ記事 をご覧ください。 免責事項...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

Important: Red Hat Security Advisory: nodejs:24 security update

An update for the nodejs:24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

nodejs24 security, bug fix, and enhancement update

An update is available for nodejs24. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a platform built on Chrome's JavaScript runtime for easily...

nodejs22 security update

An update is available for nodejs22. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Node.js is a platform built on Chrome's JavaScript runtime \ for easily...

CVE-2020-9273

CVE-2020-9273 これは、CVE-2020-9273（ProFTPdにおけるヒープ領域のuse-after-free（解放後使用）脆弱性）の分析と悪用の過程で作成したファイル群です。 エクスプロイト動画はこちらからご覧いただけます。 このリポジトリ内のファイルの説明： poc-not-really-v4.c - 去年（2020年10月）に書いた記事とPoC。悪用経路を理解するために読んでください; exploitdemo.c - 公開されたデモエクスプロイト。ハードコードされたアドレス入りで、これも去年のもの; exploitproftpd.c -...

CVE-2026-71847

A flaw was found in Ruby JSON. A heap-use-after-free vulnerability exists in the JSON::ResumableParser component. A remote attacker, by supplying a specially crafted JSON stream with truncated duplicate keys, can cause the application to dereference freed memory. This can lead to process...

RLSA-2026:62219 Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion...

nodejs:22 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

CVE-2018-1000030

CVE-2018-1000030 Python 2.7.14 は、Heap-Buffer-Overflow および Heap-Use-After-Free に対して脆弱です。2.7.14 より前の Python バージョンも 脆弱である可能性があり、Python 2.7.17 以前も脆弱である可能性があるように見えますが、 これは確認されていません。 ERRASANTHREADC18...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...

AlmaLinux 10 : nodejs22 (ALSA-2026:61376)

The remote AlmaLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61376 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

AlmaLinux 9 : nodejs:24 (ALSA-2026:61386)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:61386 advisory. nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion via...

nodejs:22 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

nodejs:24 security update

An update is available for module.nodejs, nodejs, module.nodejs-packaging, nodejs-packaging, nodejs-nodemon, module.nodejs-nodemon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

RLSA-2026:61386 Important: nodejs:24 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw CVE-2026-58043 nodejs: Node.js: Remote memory exhaustion...

List-CVE-2025-2026

CVE-2025-69412 - KDE messagelib 25.11.90 之前的版本在 Google Safe Browsing Lookup API（又称网络钓鱼 API）中会忽略 threatMatches:find 的 SSL 错误，这可能允许…… 2. CVE-2025-69413 - 在 Gitea 1.25.2 之前的版本中，/api/v1/user 对认证失败的响应会因用户名是否存在而不同。 3. CVE-2025-13820 - Comments WordPress 插件 7.6.40 之前的版本在使用 disqus.com...

Important: Red Hat Security Advisory: nodejs:22 security update

An update for the nodejs:22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service

A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing...