wa-tunnel

wa-tunnel - Whatsapp を介した TCP トンネリング これは Baileys をベースにしたコードで、2つのWhatsappアカウントを介してTCPデータをトンネリングできます。 これは様々な状況で使用できます。例えば、WhatsAppデータが無制限のネットワークキャリアや、ソーシャルネットワークデータが無制限の飛行機内などです。 Baileysを使用しているのは、WSベースのマルチデバイスWhatsAppライブラリであり、将来的にはTermuxなどを使用してAndroidでも使用できる可能性があるからです。...

netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...

DEBIAN-CVE-2026-46387

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA...

EUVD-2026-56926

ffuf denial of service OOM via HTTP response decompression bomb...

Medium: python3.13-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Medium: python-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Medium: python3.11-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Medium: python3.12-pip

Issue Overview: Internationalized Domain Names in Applications IDNA for Python provides support for Internationalized Domain Names in Applications IDNA and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as "\u0660" N or "\u30fb" N + "\u6f22" utilize the...

Astra Linux – Vulnerability in Netty

Netty is an asynchronous event-driven network application framework for rapid development of maintainable high-performance protocol servers and clients. In Netty-Codec-Compression versions 4.1.124.Final and below, as well as Netty-Codec versions 4.2.4.Final and below, when supplied with specially...

Astra Linux – Vulnerability in Node.js

A vulnerability in Node.js has been identified, allowing for a Denial of Service DoS attack through resource exhaustion when using the fetch function to retrieve content from an untrusted URL. The vulnerability arises from the fact that the fetch function in Node.js always decodes Brotli, making ...

ROOT-APP-PYPI-CVE-2025-6176 CVE-2025-6176 in Brotli - Patched by Root

Root has patched CVE-2025-6176 in the Brotli package for Root:PyPI. Multiple fixed versions available...

netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...

Linux Distros Unpatched Vulnerability : CVE-2026-73232

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response...

CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

UBUNTU-CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

CVE-2026-73232

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go checks only the compressed Content-Length while io.ReadAll reads gzip, brotli, deflate, transparently...

netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...

netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...

Malicious code in @keyv/compress-brotli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86bff1a8498159cc349a64d9d6459b842242e7d860aa2a33649708c9fc5f456a Package @keyv/[email protected] is a Brotli compression adapter for the keyv key-value store family. No credential access, network exfiltration,...

netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression

A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli br, Zstandard zstd, or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an...