CVE-2026-6042-PoC

CVE-2026-6042: DoS por Complexidade Algorítmica no iconv da musl libc Laços de salto de lacunas no decodificador GB18030 de 4 bytes do iconv da musl permitem que uma pequena entrada maliciosa consuma tempo de CPU desproporcional. Um payload adversário de 40 KB pode prender um núcleo de CPU por ma...

CVE-2021-4034

CVE-2021-4034 Build precompilati per CVE-2021-4034. Ovviamente non dovresti fidarti dei build precompilati : Questa release funziona in modo leggermente diverso: prima viene creato un oggetto condiviso minimale. Questo oggetto viene impacchettato nel binario principale e rilasciato in fase di...

Unchecked Return Value

Overview Affected versions of this package are vulnerable to Unchecked Return Value due to improper access control in the diagnostics IPC. An attacker can gain elevated privileges by exploiting a missing error check that results in incorrect access control lists being applied to shared resources...

Unchecked Return Value

Overview Affected versions of this package are vulnerable to Unchecked Return Value due to improper access control in the diagnostics IPC. An attacker can gain elevated privileges by exploiting a missing error check that results in incorrect access control lists being applied to shared resources...

Unchecked Return Value

Overview Affected versions of this package are vulnerable to Unchecked Return Value due to improper access control in the diagnostics IPC. An attacker can gain elevated privileges by exploiting a missing error check that results in incorrect access control lists being applied to shared resources...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via unchecked input for the loop condition in the System.Net.WebSockets. An attacker can cause a denial of service by sending specially crafted network requests that trigger excessive resource...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via unchecked input for the loop condition in the System.Net.WebSockets. An attacker can cause a denial of service by sending specially crafted network requests that trigger excessive resource...

CVE-2026-44453

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca under certain conditions. When serving static files, h2o builds the file path on stack, by calling alloca. The maximum size of the memor...

CVE-2026-44453 h2o is vulnerable to musl libc stack overflow

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca under certain conditions. When serving static files, h2o builds the file path on stack, by calling alloca. The maximum size of the memor...

CVE-2026-44453

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca under certain conditions. When serving static files, h2o builds the file path on stack, by calling alloca. The maximum size of the memor...

CVE-2026-44453

The CVE-2026-44453 entry concerns the h2o HTTP server (HTTP/1.x, HTTP/2, HTTP/3). Before commit 6b5370d, h2o could trigger a Denial of Service by calling alloca to build file paths for static files, potentially allocating up to ~600 KB on the stack. This exceeds the musl libc pthread stack defaul...

CVE-2026-44453 h2o is vulnerable to musl libc stack overflow

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca under certain conditions. When serving static files, h2o builds the file path on stack, by calling alloca. The maximum size of the memor...

CVE-2026-55213 h2o: musl libc stack overflow (QPACK)

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling...

CVE-2026-55213

CVE-2026-55213 (h2o HTTP server) – Affected component: lib/http3/qpack.c, invoked while processing a QPACK instruction over HTTP/3. Root cause: on-stack allocation of a large buffer (up to ~800 KB) via alloca, exceeding default musl libc pthread stack size, leading to a segmentation fault when to...

CVE-2026-55213 h2o: musl libc stack overflow (QPACK)

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling...

Microsoft Security Advisory CVE-2026-45591 – ASP.NET Core Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in ASP.NET Core SignalR and Blazor Server. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial of service...

FreeBSD : h2o -- stack overflow serving static files on musl libc (644d5e6c-1bd9-4904-8440-16c04100a2e1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 644d5e6c-1bd9-4904-8440-16c04100a2e1 advisory. h2o project reports: When serving static files, h2o can allocate a file path on the stack using alloca...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can exhaust system resources by sending specially crafted requests over the network, resulting in service unavailability for legitimate users. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can exhaust system resources by sending specially crafted requests over the network, resulting in service unavailability for legitimate users. Remediation Upgrade...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can exhaust system resources by sending specially crafted requests over the network, resulting in service unavailability for legitimate users. Remediation Upgrade...