splinter

splinter splinter is a jvm analysis toolkit, allowing the user to view classes, methods, fields, constant pools and bytecode on runtime. this was made and tested on openjdk build 22.0.2+9-70 what is splinter? usually, when you think of an analysis toolkit for the jvm, you would think it uses jni ...

cve-2022-42889-intercept

cve-2022-42889-intercept For versions below Java 11, special attention is required, as higher versions have already removed the Javascript interpreter. This solution targets Java 8. Intercept illegal parameters via JVM startup parameters and jps pid. quick start -----------------------load...

PT-2026-117364

Use of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The OAuth2 client token cache is global to the JVM, and its key omitted several of the fields that determine what a tok...

CVE-2015-7501

Lab for Java Deserialization Vulnerabilities This content is related to the paper written for the 12th edition of H2HC magazine. See full paper in: https://www.h2hc.com.br/revista/ Slides and video of the talk will be available soon. Um overview sobre as bases das falhas de desserialização nativa...

CVE-2025-27533-Exploit-for-Apache-ActiveMQ

CVE-2025-27533-Exploit-for-Apache-ActiveMQ PoC exploit for CVE-2025-27533 , a Denial of Service DoS vulnerability in Apache ActiveMQ. This tool sends malicious OpenWire packets to exhaust the JVM heap memory of the target server, and potentially crashing the ActiveMQ service on port 61616. USE...

log4j-remediation-tools

log4j-remediation-tools Tools for finding and reproducing the CVE-2021-44228 log4j2 vulnerability Tools find-vulnerabilities: determine heuristically whether a running JVM is vulnerable confirm-vulnerabilities: determine with 100% accuracy whether a running JVM is vulnerable Usage Both of these...

graylog-cve-2024-24824-exploit

Exploiting Arbitrary Class Loading on the JVM This repository contains the proof-of-concept exploit presented in my talk: Exploiting Arbitrary Class Loading on the JVM Watch it here if you're interested: Youtube The exploit targets CVE-2024-24824 minor typo in the slides, an arbitrary class loadi...

Linux Distros Unpatched Vulnerability : CVE-2026-110258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors that fails to enforce the single-RET-per-JSR...

Linux Distros Unpatched Vulnerability : CVE-2026-110260

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS...

Linux Distros Unpatched Vulnerability : CVE-2026-110270

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without...

cve-2021-44228-qingteng-patch

Qingteng log4j2-patch https://github.com/qingtengyun/cve-2021-44228-qingteng-patch Fixes CVE-2021-44228 for log4j2, using the Instrumentation API provided by the JVM to modify existing bytecode loaded into the JVM. Without restarting the Java process, it modifies the lookup method of...

org.ow2.asm/asm: OW2 ASM: Denial of Service via crafted class file with overlapping exception handlers

A flaw was found in OW2 ASM. An attacker can trigger a Denial of Service DoS by providing a specially crafted Java class file containing numerous overlapping exception handlers. When the library analyzes the method stack or frame structures of such a file, it performs excessive memory allocation,...

Xjar_tips

Xjartips Introduction: Spring Boot JAR 安全加密运行工具, 同时支持的原生JAR. 基于对JAR包内资源的加密以及拓展ClassLoader来构建的一套程序加密启动, 动态解密运行的方案, 避免源码泄露以及反编译. 功能特性 无代码侵入, 只需要把编译好的JAR包通过工具加密即可. 完全内存解密, 降低源码以及字节码泄露或反编译的风险. 支持所有JDK内置加解密算法. 可选择需要加解密的字节码或其他资源文件. 支持Maven插件, 加密更加便捷. 动态生成Go启动器, 保护密码不泄露. 其中xjar...

cve-2021-44228

This Ansible playbook applies a global 'JAVATOOLOPTIONS: -Dlog4j2.formatMsgNoLookups=true' to all users. This mitigates the CVE-2021-44228 exploit for all JVM apps on the hosts in the inventory To exec: ansible-playbook playbook.yml -i inventory...

log4j-recognizer

log4j-recognizer A utility to look for log4j in the currently running JVM CVE-2021-44228 Log4Shell. This is useful for systems that allow plugins to introduce their own jars. Therefore, you can find if someone brought log4j in a dangerous version. Usage Just instantiate Log4jRecognizer with your...

io.netty/netty-codec-http: Netty: Denial of Service via unbounded concurrent SPDY streams

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

CLEANSTART-2026-TG95490 RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes

Security vulnerability affects the wso2mi package. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes...

CVE-2026-110257

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute that sizes an int array from numbootstrapmethods without validating attributelength. Attackers can supply a crafted class file of about 100 bytes that forces roughly 2 GB...

CVE-2026-110260

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal and computeAllFrames when using COMPUTEMAXS or COMPUTEFRAMES. Attackers can supply a crafted class file with thousands of overlapping exception handlers, causing excessive Edge...