655 matches found
smart-contract-vulnerabilities
スマートコントラクトの脆弱性 スマートコントラクトの脆弱性とその防止策をまとめたコレクションです。 LLM向けに最適化されたリファレンスについては /references を参照してください。 アクセス制御 tx.origin による認証 不十分なアクセス制御 信頼できない呼び出し先への Delegatecall 署名の改ざん可能性 署名リプレイ攻撃に対する保護の欠如 数学 整数オーバーフローとアンダーフロー オフバイワン 精度の欠如 制御フロー 再入 ブロックガスリミットによる DoS 予期しない revert による DoS ループ内での msg.value の使用...
evm-audit-helpers
evm-audit-helpers 概要 evm-audit-helpers は、EVMスマートコントラクトのセキュリティ監査を迅速化するために設計された、厳選されたSolidityスニペット、Foundryスクリプト、テストテンプレートのコレクションです。このリポジトリには、リエントランシー、ストレージレイアウトの不一致、ガス最適化の落とし穴など、一般的な監査上の懸念事項に対応する再利用可能なビルディングブロックがバンドルされており、監査人や開発者は定型コードではなくロジックに集中できます。 主な目標: 監査準備を迅速化 するための既製チェックとパターンを提供。...
CVE-2025-4126
POC-CVE-2025-4126 スマートコントラクトのリエントランシー攻撃の脆弱性の検証 スマートコントラクトのリエントランシー攻撃PoC このリポジトリには、Ethereumスマートコントラクトにおけるリエントランシー攻撃 の脆弱性を示す概念実証（PoC）が含まれています。このPoCには、脆弱なスマートコントラクト、攻撃者コントラクト、およびローカルテスト環境で攻撃を再現するための手順が含まれています。 目次 概要 脆弱性の説明 PoCのセットアップ PoCの実行 ライセンス 概要...
CVE-2026-1111-Smart-Contract-Cross-Function-Reentrancy
CVE-2026-1111 – スマートコントラクトにおけるクロスファンクション再入攻撃 プログラムコード Solidity + Python root@kitploit: // VulnerableBank.sol - Simplified reentrancy example with cross-function bypass pragma solidity ^0.8.0; contract VulnerableBank mappingaddress = uint256 public balances; function deposit public payable...
Astra Linux – Vulnerability in Qemu
A reentrancy issue related to DMA was discovered in the USB EHCI controller emulation of QEMU. EHCI does not verify whether the Buffer Pointer overlaps with its MMIO region when transferring USB packets. Crafted content may be written to the controller’s registers, potentially triggering...
Astra Linux – Vulnerability in Qemu
A reentrancy issue with DMA was discovered in the Tulip device emulation in QEMU. When Tulip reads from or writes to the rx/tx descriptor, or copies the rx/tx frame, it does not check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers...
Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: netsched: qfq: A double addition of a classifier was corrected in the class, where netem is a child qdisc. As described in Gerrard’s report 1, there are use cases where a netem child qdisc can make the parent qdisc’s enqueue...
Astra Linux – Vulnerability in Qemu
A double-free vulnerability was identified in QEMU virtio devices virtio-gpu, virtio-serial-bus, virtio-crypto. The memreentrancyguard flag does not provide sufficient protection against reentrancy issues related to DMA operations. This vulnerability could allow a malicious privileged guest user ...
Astra Linux – Vulnerability in Qemu
A reentry vulnerability was identified in the NVM Express Controller NVME emulation in QEMU. This CVE is similar to CVE-2021-3750. Just like in that case, when the reentry trigger causes the nvmectrlreset function to be called, data structures will be freed, leading to a use-after-free issue. A...
EUVD-2026-75095
In the Linux kernel, the following vulnerability has been resolved: iouring: defer eventfd signaling when queued from a wakeup handler ioreqlocalworkadd signals the CQ ring eventfd inline when it is the one to push the first entry onto -worklist. For DEFERTASKRUN rings that add is frequently done...
CVE-2026-80920
CVE-2026-80920 affects the Linux kernel io_uring subsystem. The root cause is that io_req_local_work_add() signals the CQ ring eventfd inline when it pushes the first entry onto ->work_list. For DEFER_TASKRUN rings, this add is frequently done from a waitqueue wakeup handler where an arbitrary...
CVE-2026-80920 io_uring: defer eventfd signaling when queued from a wakeup handler
In the Linux kernel, the following vulnerability has been resolved: iouring: defer eventfd signaling when queued from a wakeup handler ioreqlocalworkadd signals the CQ ring eventfd inline when it is the one to push the first entry onto -worklist. For DEFERTASKRUN rings that add is frequently done...
PT-2026-89090
In the Linux kernel, the following vulnerability has been resolved: io uring: defer eventfd signaling when queued from a wakeup handler io req local work add signals the CQ ring eventfd inline when it is the one to push the first entry onto -work list. For DEFER TASKRUN rings that add is frequent...
Exploit for CVE-2026-56848
CVE-2026-56848 NVD Description A flaw in Node.js HTTP/2...
ANT-2026-Z3GGGKM5 · ava-labs/libevm · Denial of Service / Nil Pointer Dereference
denial-of-service high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Anvil Security. ANT-2026-Z3GGGKM5: Reentrancy guard dereferences nil StateDB...
PT-2026-73406
A flaw in Node.js HTTP/2 handling allows nghttp2 session mem send to be called re-entrantly while nghttp2 session mem recv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
PT-2026-73396
A flaw in Node.js HTTP/2 handling allows nghttp2 session mem send to be called re-entrantly while nghttp2 session mem recv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-56848
A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-56848
A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
curl: Heap use-after-free (write) in mev_forget_socket() via reentrant curl_easy_pause() — incomplete fix for CVE-2026-9080
lib/multiev.c keeps a hash table multi-ev.shentries of per-socket bookkeeping structs struct mevshentry used to decide when to notify the application's socket callback CURLMOPTSOCKETFUNCTION about interest changes on a socket. CVE-2026-9080 "multi: handle pause in multi socket callback", commit...