hickory-resolver follows irrelevant CNAME records

When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records...

GHSA-6F2X-V7Q7-M7M5 hickory-resolver follows irrelevant CNAME records

When the Hickory DNS resolver follows CNAME records, it sends queries that are not necessary to answer the original recursive query. If there are any CNAME records in the authority section or additional section of the response, queries will be sent for those names. If there are any CNAME records...

CVE-2026-30784-rustdesk-poc

CVE-2026-30784-rustdesk-poc CVE-2026-30784: RustDesk hbbs ट्रैफ़िक एम्प्लीफिकेशन PoC और PCAP विश्लेषण प्रमुख निष्कर्ष मुख्य खोज: कुंजी-आधारित प्रमाणीकरण -k को लागू करना इस एम्प्लीफिकेशन हमले को नहीं रोकता , क्योंकि एम्प्लीफिकेशन प्रतिक्रिया अप्रमाणित प्रारंभिक हैंडशेक/पिंग चरण के दौरान ट्रिगर होत...

http2-bomb

HTTP/2 Bomb - CVE-2026-49975 एक डेनियल-ऑफ-सर्विस DoS प्रूफ ऑफ कॉन्सेप्ट जो HTTP/2 सर्वरों को लक्षित करता है। HPACK प्रवर्धन और स्ट्रीम प्रतिधारण को संयोजित करके, एक मामूली नेटवर्क कनेक्शन वाली एकल मशीन कुछ सेकंड के भीतर एक कमज़ोर सर्वर को अनुपलब्ध कर सकती है। भेद्यता CVE: CVE-2026-49975 शीर्षक:...

CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

CVE-2026-105686

The open-source design and prototyping platform Penpot is vulnerable to temporary-storage amplification in versions prior to 2.18.0 . The issue exists within the chunked media upload RPC , which fails to reject or replace previously stored chunk indexes. An authenticated user can repeatedly uploa...

CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

CVE-2026-105686 Penpot: Repeated chunk index causes temporary-storage amplification

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in range but neither rejects an already stored index nor replaces its previous object. An authenticated user can repeatedly upload the same valid index, causing...

CVE-2026-104712

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-104712

An asymmetric resource consumption (amplification) vulnerability exists in Apache Struts (versions 2.5.14 through 2.5.33, 6.0.0 through 6.11.0, and 7.0.0 through 7.3.0). The flaw occurs when a request parameter is bound to a java.math.BigDecimal property and subsequently rendered via the Struts t...

CVE-2026-104712 Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

http2-bomb-analysis-paper

قنبلة HTTP/2: هجوم سلسلة تضخيم المراجع المفهرسة لـ HPACK غوص تقني مستقل لطالب مدرسة ثانوية يونيو 2026 خلاصة يحتوي هذا المستودع على تحليلي الكامل لثغرة قنبلة HTTP/2 CVE-2026-49975 / CVE-2026-47774، والتي تربط بين بدائيتين من HTTP/2 عمرهما عقدان: تضخيم المراجع المفهرسة لـ HPACK – إرسال آلاف المراجع...

CallStranger

CallStranger هذا السكريبت أنشأه Yunus Çadırcı https://twitter.com/yunuscadirci للتحقق من ثغرة CallStranger CVE-2020-12695. يمكن للمهاجم استخدام هذه الثغرة من أجل: تجاوز DLP لتسريب البيانات استخدام ملايين أجهزة UPnP المواجهة للإنترنت كمصدر لهجمات TCP DDoS / SYN Flood الانعكاسية المضخّمة فحص المناف...

CVE-2026-104712: Asymmetric Resource Consumption (Amplification)

Asymmetric resource consumption amplification vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal java.math.BigDecimal property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude large...

CVE-2026-66054

Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94636

Improper handling of highly compressed data data amplification, Function call with incorrectly specified arguments, Improper validation of specified quantity in input vulnerability in Apache Thrift py bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to...

CVE-2026-94637

Improper handling of highly compressed data data amplification vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

http2-bomb

HTTP/2 Bomb — CVE-2026-49975 HTTP/2 تضخيم التدفقات · إثبات المفهوم · Docker · وحدة تحكم ويب الثغرة يتيح HTTP/2 تعدد الإرسال multiplexing لعدة تدفقات عبر اتصال TCP واحد. يصوغ هذا الإثبات PoC إطارات HEADERS مُشكَّلة خصيصًا تحتوي على عدد كبير من المراجع الداخلية، مما يُجبر الخادم على تخصيص كميات هائ...

certified-unlearning-neural-networks-icml-2025

النسيان المعتمد للشبكات العصبية يحتوي هذا المستودع على التنفيذ البرمجي للورقة البحثية "النسيان المعتمد للشبكات العصبية" ICML 2025. الأساليب PABI تضخيم الخصوصية عبر التكرار : Gradient Clipping في الورقة DP-SGD : مع خصوصية المجموعة كما هو موصوف في الورقة المعاملات الانكماشية : Model Clipping في...

Linux Distros Unpatched Vulnerability : CVE-2026-66054

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++ bindings...