EUVD-2026-109436

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls loadaudio without the maxdurations decoded-duration limit. Authenticated attackers can send small compressed audio via inputaudio or audiourl in /v1/chat/completions requests...

PNGboomer-CVE-2026-77622

PNGboomer — CVE-2026-77622 Denial-of-service exploit for Sliver C2's HTTPS listener. Brute-forces the per-session PNG encoding nonce and delivers a decompression bomb that exhausts server memory. Published as GHSA-663m-7x7m-g4fw. Summary Sliver's HTTPS C2 channel wraps messages inside PNG images...

CVE-2026-116175

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls loadaudio without the maxdurations decoded-duration limit. Authenticated attackers can send small compressed audio via inputaudio or audiourl in /v1/chat/completions requests...

CVE-2026-116177

The vLLM library, versions 0.10.2 before 0.25.0 , is vulnerable to a Denial of Service (DoS) attack due to uncontrolled resource consumption. The root cause is that Nemotron-VL processors globally set Image.MAX_IMAGE_PIXELS to None, bypassing decompression-bomb guards. Unauthenticated attackers c...

CVE-2026-116175 vLLM 0.19.0 before 0.24.0 Audio Decompression Bomb DoS via Chat Completions

vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path calls loadaudio without the maxdurations decoded-duration limit. Authenticated attackers can send small compressed audio via inputaudio or audiourl in /v1/chat/completions requests...

CVE-2026-116175

The vLLM framework versions 0.19.0 through 0.24.0 are vulnerable to an Audio Decompression Bomb (CWE-409). The root cause is that the AudioMediaIO multimodal path calls load_audio without enforcing the max_duration_s decoded-duration limit. This allows authenticated attackers to submit small, hig...

CVE-2026-31899

CVE-2026-31899: Exponential DoS via Recursive Element Amplification in CairoSVG Keywords: CVE-2026-31899, CairoSVG, exponential DoS, SVG bomb, recursive use element, denial of service, XML amplification, Python SVG vulnerability, CWE-400, uncontrolled resource consumption, billion laughs SVG Tabl...

wheelaudit

wheelaudit Python Wheel File Security Scanner — scan .whl files for security issues before installation. Motivated by recent CVEs in Python wheel handling: CVE-2026-24049 : Path traversal in wheel unpack allows permission manipulation of system files CVE-2026-1703 : Path traversal when pip instal...

CVE-2026-49975-POC

CVE-2026-49975 — HTTP/2 Bomb PoC Proof-of-concept exploit for CVE-2026-49975, a remote denial-of-service vulnerability in HTTP/2 server implementations. Discovered by Quang Luong Calif Security Research, disclosed June 2, 2026. For authorized security testing only. Do not use against infrastructu...

zip_bomb

ZIP Bomb Creator ZIP Bomb Creator is a tool used to create a ZIP file that is small in size but drastically expands when extracted. This is useful for security experiments and testing file systems against ZIP Bomb attacks. Features Create a ZIP Bomb with configurable file count and size. Supports...

cve-2026-49975-http2bomb_reproduction

CVE-2026-49975 HTTP/2 Bomb Complete Reproduction Guide Based on QiAnXin CERT Advisory + Calif Original Research ================================================================ I. Vulnerability Overview CVE-2026-49975 is a critical denial-of-service DoS vulnerability in HTTP/2 server and proxy...

log4j-exploit-fork-bomb

log4j-exploit-with-fork-bomb 💣💥💀 Proof of Concept: example of launching a fork bomb on a remote server due to vulnerability CVE-2021-44228 1. Create an attacker's LDAP server server module that will serve string and code payloads payload module 2. Create a victim example victim module and pass a...

CVE-2019-12401

CVE-2019-12401: XML Bomb in Apache Solr Solr versions prior to 5.0.0 are vulnerable to an XML resource consumption attack a.k.a. Lol Bomb via its update handler. By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML...

POC-CVE-2026-49975

-red CVE-2026-49975 HTTP/2 Bomb — HPACK Compression Bomb + Flow-Control Hold PoC Security Research PoC by naheeju ⚠️ This is a working, memory-exhaustion DoS tool — not a toy. It opens streams that force the target to allocate memory and holds them open via HTTP/2 flow-control tricks. As long as...

CVE-2022-24999

CVE-2022-24999 This repository contain exploits samples of the vulnerability we found in the JS library "qs" in december 2021. This vulnerability was fixed in express v4.17.3 & qs v6.10.3 v6.9.7, v6.8.3, v6.7.3, v6.6.1, v6.5.3, v6.4.1, v6.3.3, and v6.2.4. qs Array & String Bombs Vulnerable versio...

ExWA

ExWa WhatsApp for CLI with API ExWa is a simple tool written in PHP, which functions to use a CLI version of WhatsApp application with help of API from rapiwha.com Installation : $ git clone https://github.com/dalpan/ExWa $ cd ExWa $ php exwa.php Usage : Register first at https://rapiwha.com/ and...

CVE-2026-49975-HTTP-2-Bomb

A triage not exploitation tool to identify attack surfaces exposed to CVE-2026-49975 — "HTTP/2 Bomb". ⚠️ This script does not send attack payloads. It only makes normal HTTP requests and analyzes response headers to flag hosts that warrant manual version/patch verification. About CVE-2026-49975...

CVE-2026-49975

CVE-2026-49975 HTTP/2 Bomb ★ CVE-2026-49975 HTTP/2 Bomb PoC ★ Overview CVE-2026-49975 is a Denial of Service DoS vulnerability in Apache HTTP Server. The vulnerability occurs in the HTTP/2 request handling path, where multiple cookie header fields can be merged without being properly counted...

CVE-2025-63914

CVE-2025-63914 Public disclosure and patch for CVE-2025-63914: Zip bomb vulnerability in Cinnamon/kotaemon. Credit Wang Yuanrong Summary The mayextractzip function fails to enforce limits on ZIP decompression, allowing a malicious ZIP bomb to trigger excessive resource consumption and denial of...

http2-bomb-detector

http2-bomb-detector HTTP/2 Bomb CVE-2026-49975 Non-destructive vulnerability detection tool — for Nginx / Apache httpd Vulnerability Background CVE-2026-49975 is a widespread remote denial-of-service vulnerability in the HTTP/2 protocol layer, discovered by security researcher Quang Luong. This...