MS15-034

MS15-034 MS15-034 POC "現在のIISサーバーバージョンは、既知の脆弱性CVE-2015-1635, MS15-034が存在する脆弱なバージョンであり、この脆弱性を悪用されると、リモートコード実行やブルースクリーンの誘発などの攻撃を受けるリスクがあります。 テスト構文 : wget --header=""Range: bytes=0-18446744073709551615"" ブルースクリーン誘発攻撃構文 : wget --header=""Range: bytes=18-18446744073709551615"" ※...

KillApachePy

セキュリティのトレンドを追っているなら、特別に細工されたRangeヘッダーを使用して多数のApacheバージョンに対するDoS攻撃（CVE-2011-3192）について聞いたことがあるでしょう。元のPoC（killapache.pl）に基づいて、私はPython版を作成しました。これはよりユーザーフレンドリーで、いくつかのプログラムワークフローの強化（システムで許可される最大スレッド数の自動使用、カスタムHTTPメソッド（GET/HEAD/...）の設定、取得するカスタムターゲットページ、プロキシサポートなど）を備えています。 p.s. このツールの実行にはPython...

nginx-CVE-2017-7529

Nginxのキャッシュ範囲外読み取りの脆弱性（CVE-2017-7529） 脆弱性の原理 参考資料： https://cert.360.cn/detailnews.html?id=b879782fbad4a7f773b6c18490d67ac7 http://galaxylab.org/cve-2017-7529-nginx%E6%95%B4%E6%95%B0%E6%BA%A2%E5%87%BA%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/...

CVE-2017-7529-

CVE-2017-7529-Nginx Range Header Integer Overflow Nginxは高性能なWebサーバーであり、リバースプロキシ、キャッシュサーバーなどとして広く使用されているオープンソースのWebサーバーです。 Nginx 1.13.2以下のバージョンにおいて、整数オーバーフローにより攻撃者がRangeヘッダを操作し、本来の応答範囲を超えたメモリ断片や機密情報を漏洩できる脆弱性が存在します。 Reference https://www.freebuf.com/articles/web/140178.html 脆弱な環境構成...

Rocky Linux 10.0 [CIQ] Security Update: libsoup3 / libsoup3-debuginfo / libsoup3-debugsource / etc Multiple Vulnerabilities (crlsa-2025_8128)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20258128 advisory. libsoup: Denial of Service attack to websocket server CVE-2025-32049 libsoup: Denial of service in server when client requests a large amount of...

Rocky Linux 8 [CIQ] Security Update: libecap / libecap-debuginfo / libecap-debugsource / libecap-devel / etc Multiple Vulnerabilities (crlsa-2021_4292)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20214292 advisory. squid: denial of service in URN processing CVE-2021-28651 squid: denial of service issue in Cache Manager CVE-2021-28652 squid: denial of service in HTTP...

EXP-CVE-2017-75

EXP-CVE-2017-75 このPythonスクリプトは、NGINXサーバーの特定の脆弱性（CVE-2017-75）をチェックし、悪用するために設計されています。これは、私が最近報告書を提出した公開脆弱性開示プログラムのために開発されました。 巧妙に細工されたRangeヘッダーを使用してオーバーフローを引き起こし、サーバーのメモリから機密情報を取得できるようにします。 機能 確認モード : 完全なエクスプロイトを実行せずに、ターゲットURLが脆弱かどうかを迅速に確認します。 エクスプロイトモード : ターゲットが脆弱な場合、この脆弱性を悪用してメモリ内容を取得しようとします。...

SUSE CVE-2026-77680

An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7a corrected merge correctness in...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in Starlette (CVE-2026-54283)

Summary A resource exhaustion Denial of Service vulnerability in the Starlette ASGI framework library CVE-2026-54283 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 1.3.1. Vulnerability Details CVEID:CVE-2025-54121 DESCRIPTION: Starlette is a...

OESA-2026-3825 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing...

OESA-2026-3782 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTT...

Astra Linux – Vulnerability in Rails

Active Storage allows users to attach cloud and local files in Rails applications. Prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1, when serving files through Active Storage’s proxy delivery mode, the proxy controller would load the entire requested byte range into memory before sending it. A...

Astra Linux – Vulnerability in Ruby-Rack

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the...

Astra Linux – Vulnerability in Ruby-Rack

A denial-of-service vulnerability exists in the Range header parsing component of Rack, version 1.5.0 and later. A carefully crafted input can cause the Range header parsing component in Rack to take an unexpectedly long time, potentially leading to a denial-of-service attack. Any applications th...

PT-2026-89696

Summary When backend/local is used with --links/-l or the links=true config option, each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open decodes an incoming fs.RangeOption via Decodeo.Size, then for a translated-symlink object pass...

OESA-2026-3694 libsoup3 security update

Libsoup is an HTTP library implementation in C. It was originally part of a SOAP Simple Object Access Protocol implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing...

OESA-2026-3690 libsoup security update

libsoup is an HTTP client/server library for GNOME. It uses GObjects and the glib main loop, to integrate well with GNOME applications, and also has a synchronous API, for use in threaded applications. Security Fixes: A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTT...

Security update for wget (important)

openSUSE security update: security update for wget ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21665-1 Rating: important References: bsc1271033 bsc1271034 bsc1271035 bsc1271036 bsc1271320 bsc1272219 bsc1273449 Cross-References: CVE-2026-15146...

CVE-2026-72813

A flaw was found in actix-files. This vulnerability allows a remote attacker to trigger a Denial of Service DoS by sending a GET request with an empty Range header when the application is configured to abort on panic. This can lead to the application crashing on demand. Mitigation Mitigation for...

Linux Distros Unpatched Vulnerability : CVE-2026-77680

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory...