CVE-2021-42697

Akka HTTP 10.1.x（10.1.15未満）および10.2.x（10.2.7未満）では、HTTPヘッダーの解析中にスタック枯渇が発生する可能性があり、これによりリモートの攻撃者が深くネストされたコメントを含むUser-Agentヘッダーを送信してサービス拒否攻撃を行うことができます。 参考文献 MITRE Akka ブログ コメントの任意のネスト 基本的なAkkaセットアップガイド PoC ノート テスト対象バージョン: 10.2.4 ターゲットサーバーのフィンガープリント: akka-http/ ペイロードスニペット: User-Agent:...

katana

Katana 2016년부터 2019년 사이에 출시된 Qualcomm 기기를 위한 BootROM 익스플로잇입니다. 익스플로잇 간략 설명 MSM8998 Nazgul SoC에서는 0x13 SAHARARESETSTATEMACHINEID 명령이 추가되었습니다. 이 명령은 bootsaharaentry를 호출하는데, 이 함수는 Sahara를 재초기화하기 위한 것입니다. 취약점은 이 함수를 호출할 때마다 스택 포인터가 0x60만큼 감소하고 스택 보호 장치가 없다는 점입니다. 충분히 많은 호출을 통해 사용 가능한 스택 공간0x3000을...

Damn_Vulnerable_C_Program

참고: 파일 이름이 imgRead.c에서 dvcp.c로 변경되었습니다. 동영상을 보고 있다면 imgRead.c가 보이겠지만 GitHub 저장소에는 dvcp.c가 있습니다. 올바른 파일 이름을 사용하세요. Damn Vulnerable C ProgramDVCP 내 YouTube 채널: https://www.youtube.com/user/MrHardik05/featured?viewas=subscriber 이것은 무엇인가? 이것은 제가 일반적인 유형의 취약점을 설명하기 위해 작성한 간단한 C 프로그램입니다: 1. 정수 오버플로우 2...

CVE-2026-82617 Apache OpenNLP, Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns

The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULTREGEXNAMEFINDER.EMAIL and DEFAULTREGEXNAMEFINDER.URL - contain ambiguous nested quantifiers. An application that obtains these finders through RegexNameFinderFactory.getDefaultRegexNameFinders...

CVE-2026-82617

Apache OpenNLP versions 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 are affected by ambiguous nested quantifiers in the built-in EMAIL and URL name-finder patterns of RegexNameFinderFactory. The EMAIL pattern suffers quadratic-time ReDoS: a ~32 KB input without an @ forces re-scanning from...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CVE-2026-88763

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

CVE-2026-88763

A flaw in the skupper-router component of Red Hat Service Interconnect allows denial of service via unbounded recursion in the AMQP field parser . When the router processes a specially crafted network message, the lack of recursion bounds can exhaust stack memory, causing a crash and disrupting t...

EUVD-2026-75288

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

CVE-2026-88763

A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distributed services. The issue occurs when the router processes a specially crafted network message using its AMQP field parser. Due to a lack of bounds on...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

CLEANSTART-2026-GB90768 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Multiple security vulnerabilities affect the logstash-exporter package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

CLEANSTART-2026-AJ83096 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Multiple security vulnerabilities affect the logstash-exporter package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

CVE-2026-22591

eProsima Fast DDS , a C++ implementation of the OMG DDS standard, is affected by a remote denial-of-service vulnerability in its DDSSQLFilter (SQL-based content filtering) component. The root cause is recursive parser stack exhaustion triggered by a deeply nested filter expression in the PID_CONT...

CVE-2026-22591 Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS)

eprosima Fast DDS is a C++ implementation of the DDS Data Distribution Service standard of the OMG Object Management Group. Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering DDSSQLFilter allows any participant in a DDS domain to remotely...

encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal

A flaw was found in the encoding/asn1 package in Go. An attacker could provide a specially crafted, deeply-nested Abstract Syntax Notation One ASN.1 structure, leading to excessive recursion during the Unmarshal operation. This could result in stack exhaustion and a Denial of Service DoS conditio...