Lucene search
+L

5604 matches found

Kitploit
Kitploit
•added 2026/09/24 4:01 p.m.•12 views

CVE-2026-22019-libcurl-HTTP-2-CONNECT-Tunnel-Mixup

CVE-2026-22019 – libcurl HTTP/2 CONNECT トンネル混線 プログラムコード(C シミュレーション) root@kitploit: // curlhttp2tunnelmixup.c - Simulated libcurl handling CONNECT over HTTP/2 include void handlehttp2streamint streamid // Vulnerability: after CONNECT, the proxy mixes streams with the tunneled data if streamid == 0...

5.4CVSS7.5AI score0.00152EPSS
SaveExploits0
Kitploit
Kitploit
•added 2026/09/24 3:08 p.m.•10 views

CVE-2023-44487-HTTP-2-Rapid-Reset-Attack

PoC - CVE-2023-44487: HTTP/2 Rapid Reset Attack このリポジトリには、CVE-2023-44487 (別名 HTTP/2 Rapid Reset Attack )の脆弱性の悪用を実証する Proof of Concept(PoC)が含まれています。この脆弱性は HTTP/2 プロトコルに影響を与え、攻撃者が RSTSTREAM を使ってすばやく閉じられるストリームを利用して Web サーバーに過大な負荷をかけることを可能にします。 📌 説明 CVE-2023-44487 は HTTP/2...

7.5CVSS7.1AI score0.99999EPSS
SaveExploits21
Kitploit
Kitploit
•added 2026/09/24 3:05 p.m.•14 views

HTTP-2-Rapid-Reset-DDos

HTTP/2 Rapid Reset DoS攻撃 説明 このプロジェクトは、Containernetで作成したカスタムネットワークトポロジを使用して、HTTP/2 Rapid Resetサービス拒否(DoS)攻撃を実演します。この攻撃はHTTP/2プロトコルの脆弱性を悪用し、対象サーバーに過負荷をかけて応答不能にします。 トポロジ インストール 必要なパッケージをインストールするには、次のコマンドを実行します。 root@kitploit: ./install.sh デフォルトのインストールディレクトリを変更するには、INSTALLDIR変数を次のように変更できます。...

6AI score
SaveExploits0
Kitploit
Kitploit
•added 2026/09/24 2:52 p.m.•9 views

CVE-2026-42945

CVE-2026-42945 PoC(Go) 中文 | English nginx HTTP/2 実装(CVE-2026-42945) に対する探索・悪用補助ツールで、認可された環境 で脆弱性の有無を確認し、修正効果と比較し、制御された実験環境でPoCの動作を再現するためのものです。 影響を受けるバージョン(おおよその判断):nginx 0.6.27 – 1.30.0 ;1.30.1+ / 1.31.0+ は修正済み。 ⚠️ 免責事項(必読) このリポジトリは、セキュリティ研究、脆弱性確認、防御テスト専用です。 1. 合法的な許可 :明確な書面による許可 があるか、完全にあなたが所有する...

9.2CVSS7.9AI score0.03396EPSS
SaveExploits42References1
Kitploit
Kitploit
•added 2026/09/24 2:52 p.m.•6 views

HTTP-2-RapidReset-CVE-2023-44487-Testlab

このリポジトリは、私の論文研究のために作られたDockerラボのソースコードです。...

7.5CVSS6.9AI score0.99999EPSS
SaveExploits21
Kitploit
Kitploit
•added 2026/09/24 12:07 p.m.•5 views

CVE-2019-9511_Priority-Churn-Data-Dribble

HTTP/2 CVE-2019-9511 & CVE-2019-9513 Lightweight Probes CVE CVE-2019-9511 および CVE-2019-9513 に関連する動作を軽量に検証するためのスクリプトリポジトリです。両CVEはHTTP/2実装におけるサービス拒否ベクトルに関連しています。 これらのスクリプトは、許可された環境での技術的な検証を支援するために作成されました。サーバーがHTTP/2をネゴシエートし、Data Dribble や Priority Churn に関連する特定のパターンに応答するかどうかを、サービス拒否攻撃を実行せずに観察できます。...

7.8CVSS7.9AI score0.81556EPSS
SaveExploits0
Kitploit
Kitploit
•added 2026/09/24 11:58 a.m.•10 views

tomcat-embed-core-9.0.31-CVE-2020-11996

TestHttp2Section51.javaのtestImplicitCloseLargeIdユニットテストのPoCを参照してください: https://github.com/rusakovichma/tomcat-embed-core-9.0.31-CVE-2020-11996/blob/master/test/org/apache/coyote/http2/TestHttp2Section51.java...

7.5CVSS7.8AI score0.26699EPSS
SaveExploits0References1
Kitploit
Kitploit
•added 2026/09/24 11:55 a.m.•11 views

CVE-2026-49975-HTTP-2-Bomb

CVE-2026-49975 —「HTTP/2 Bomb」にさらされた攻撃対象領域を特定するためのトリアージ (悪用ではない)ツールです。 ⚠️ このスクリプトは攻撃ペイロードを送信しません 。通常のHTTPリクエストのみを行い、レスポンスヘッダーを分析して、手動でのバージョン/パッチ確認が必要なホストをフラグ付けします。 CVE-2026-49975 について 2026年6月3日に公開された「HTTP/2 Bomb」は、HPACK圧縮爆弾とSlowlorisスタイルのホールドを組み合わせた未認証のリモートDoSであり、デフォルトのHTTP/2設定でnginx、Apache...

7.6AI score0.04169EPSS
SaveExploits10
Kitploit
Kitploit
•added 2026/09/24 7:24 a.m.•15 views

CVE-2026-23918-Passive-Audit

CVE-2026-23918 監査スクリプト あるいは、単にヘッダーを curl して覗いてみることもできますが、ここでは次のツールを紹介します: Apache HTTP Server 向け非侵襲型 HTTP メタデータ監査ツール CVE-2026-23918 https://www.openwall.com/lists/oss-security/2026/05/04/19 の暴露トリアージ。 このツールは通常の HTTP HEAD/GET リクエストを送信し、TLS ALPN ネゴシエーションを実行して HTTP/2 サポートを確認します。 要件 Python 3.13 以降 uv u...

8.8CVSS8.3AI score0.49727EPSS
SaveExploits18
OSV
OSV
•added 2026/09/24 6:49 a.m.•5 views

CLEANSTART-2026-QY50458 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the fluent-operator package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

9.8CVSS5.8AI score0.00568EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
•added 2026/09/24 3:18 a.m.•7 views

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

7.5CVSS5.9AI score0.00568EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
•added 2026/09/24 2:17 a.m.•7 views

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

7.5CVSS5.9AI score0.00568EPSS
SaveExploits0References8
Tenable Nessus
Tenable Nessus
•added 2026/09/24 12:00 a.m.•8 views

Linux Distros Unpatched Vulnerability : CVE-2026-86350

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inconsistent interpretation of HTTP/2 requests 'HTTP Request/Response smuggling' vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293...

9.8CVSS7.9AI score0.0168EPSS
SaveExploits1References3
Tenable Nessus
Tenable Nessus
•added 2026/09/24 12:00 a.m.•9 views

Linux Distros Unpatched Vulnerability : CVE-2026-77762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat allows an attacker to inject trailer...

8.1CVSS5.8AI score0.00361EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
•added 2026/09/24 12:00 a.m.•6 views

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124470)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124470 advisory. Due to missing nil check, sending 0x0a-0x0f HTTP/2 frames will cause a running server to panic Tenable has extracted the preceding description block directly from th...

7.5CVSS5.9AI score0.00654EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
•added 2026/09/24 12:00 a.m.•4 views

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124479 advisory. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

7.5CVSS5.9AI score0.00568EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
•added 2026/09/23 10:51 p.m.•8 views

CVE-2026-59980

A flaw was found in hpack, an HTTP/2 Header Encoding for Python. Unbounded variable integer decoding can lead to excessive computation when processing specially crafted, malformed input. A remote attacker could exploit this vulnerability to cause a denial of service by effectively blocking furthe...

6.3CVSS7.2AI score0.00301EPSS
SaveExploits0References7
RedHat Linux
RedHat Linux
•added 2026/09/23 10:13 p.m.•7 views

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

7.5CVSS5.9AI score0.00568EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/09/23 10:07 p.m.•34 views

CVE-2026-59980 hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

6.3CVSS0.00301EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2026/09/23 9:13 p.m.•12 views

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

7.5CVSS5.9AI score0.00568EPSS
SaveExploits0References8
Rows per page
Query Builder