81 matches found
CVE-2021-31166
CVE-2021-31166 CVE-2021-31166 HTTP 프로토콜 스택 취약점 악용 시도 탐지 Suricata 규칙 Zeek 패키지 참고 자료 https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166 https://github.com/0vercl0k/CVE-2021-31166...
cve-2022-21907
CVE-2022-21907 - 1vere$k의 Golang 애플리케이션 CVE-2022-21907 - http.sys 드라이버의 이중 해제Double Free. 요약 이것은 여러 대상에 동시에 요청을 보낼 수 있는 멀티스레드 Golang 애플리케이션입니다. POST 요청에서 생산성이 높지는 않지만, 선형 방식에 비해 약 30%의 속도 향상을 제공합니다. 인증되지 않은 공격자는 "Accept-Encoding" HTTP 요청 헤더를 포함한 HTTP 요청을 보내 HTTP 프로토콜 스택http.sys 내 알 수 없는 코딩 목록에서 이...
CVE-2022-21907-http.sys
CVE-2022-21907 - http.sys 드라이버의 이중 해제 CVE-2022-21907 - http.sys 드라이버의 이중 해제 요약 인증되지 않은 공격자는 "Accept-Encoding" HTTP 요청 헤더가 포함된 HTTP 요청을 전송하여, 패킷을 처리하는 HTTP 프로토콜 스택http.sys 내부의 알 수 없는 코딩 목록에서 이중 해제를 유발하고 결과적으로 커널 크래시를 발생시킬 수 있습니다. 취약한 시스템 Windows Server 2019 및 Windows 10 버전 1809 : ❌ 기본적으로 취약하지 않습니다...
CVE-2021-31166-Exploit
CVE-2021-31166-익스플로잇 MS Http Protocol Stack RCE 취약점 CVE-2021-31166 익스플로잇 특별히 조작된 Http 요청이 취약한 윈도우 버전을 대상으로 하면 DOS 공격이 발생합니다. 그리고 서버는 블루 스크린 오류와 함께 재부팅됩니다. Http.sys는 http 요청을 처리하고 이에 대한 응답을 생성하는 윈도우 커널 드라이버입니다. 이 취약한 http.sys 드라이버는 조작된 "Accept-Encoding" 헤더를 처리할 수 없어 충돌이 발생합니다. 결과적으로 서버가 재부팅됩니다. 블루...
cve-2022-21907-http.sys
cve-2022-21907-http.sys by 1vere$k CVE-2022-21907 - http.sys 드라이버의 Double Free. 요약 인증되지 않은 공격자가 "Accept-Encoding" HTTP 요청 헤더가 포함된 HTTP 요청을 전송하여 HTTP 프로토콜 스택http.sys 내의 알 수 없는 코딩 목록unknown coding-list에서 double free를 유발하고 패킷을 처리하는 과정에서 커널 충돌을 일으킬 수 있습니다. 취약한 시스템 Windows Server 2019 및 Windows 10 버전...
CVE-2021-31166
CVE-2021-31166 왜 최근에 CVE-2021-31166에 대한 익스플로잇을 작성했습니다. 이 익스플로잇은 CVE-2021-31166을 악용합니다. 펜테스터는 https://github.com/mauricelambert/CVE-2021-31166 을 사용해야 하지만, SOC 팀에서는 취약점을 제대로 수정하기 위해 특정 취약점을 알아야 합니다. 그래서 이 익스플로잇을 작성했습니다. 설명 취약한 IIS 웹 서버를 공격하기 위해 순수 파이썬, 파워셸, 루비 스크립트와 메타스플로잇, nmap 모듈을 제공합니다 서버를 다운시키기...
Webmin < 1.920 - Authenticated Remote Code Execution
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...
Debian dla-4706 : ruby-rack - security update
The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4706 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4706-1 [email protected]...
Uncontrolled Resource Consumption (Denial Of Service)
io.netty, netty-codec-http is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the HttpContentEncoder maintaining an unbounded acceptEncodingQueue that stores attacker-controlled data without any size limit, which allows an attacker to exploit HTTP/1....
Netty: [HttpContentEncoder] Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service
Impact HttpContentEncoder the superclass of the production handler HttpContentCompressor maintains a per-channel ArrayDeque named acceptEncodingQueue that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained...
📄 HTTP.sys HTTP/2 Denial of Service
This advisory provides simple proof of concept details to trigger the HTTP/2 denial of service condition related to malformed Accept-Encoding headers. Titles: CVE-2026-49160 - HTTP.sys HTTP/2 Denial of Service DoS Vulnerability Author: nu11secur1ty Date: 06/24/2026 Vendor: Microsoft Corporation...
MGASA-2026-0226 Updated ruby-rack packages fix security vulnerabilities
CVE-2026-26961 Greedy multipart boundary parsing can cause parser differentials and WAF bypass. Forwarded header semicolon injection enables Host and Scheme spoofing. CVE-2026-34230 Quadratic complexity in Rack::Utils.selectbestencoding via wildcard Accept-Encoding header. CVE-2026-34763 Root...
USN-8182-1: Rack vulnerabilities
Andrew Lacambra discovered that Rack did not properly parse certain regular expressions. An attacker could possibly use this issue to bypass network security filters. This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 25.10. CVE-2026-26961 William T. Nelson...
Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : Rack vulnerabilities (USN-8182-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8182-1 advisory. Andrew Lacambra discovered that Rack did not properly parse certain regular...
Linux Distros Unpatched Vulnerability : CVE-2026-34230
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with...
SUSE CVE-2026-34230
Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...
CVE-2026-34230
A flaw was found in Rack. An unauthenticated attacker can exploit a vulnerability in the Rack::Utils.selectbestencoding method by sending a specially crafted Accept-Encoding header with numerous wildcard entries. This leads to quadratic time complexity during processing, causing disproportionate...
Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header
Summary Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted...
GHSA-V569-HP3G-36WR Rack has quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header
Summary Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a response encoding, an unauthenticated attacker can send a single request with a crafted...
