hulk

Hulk DoS tool HULK DoS tool ported to Go language from Python. Original Python utility by Barry Shteiman http://www.sectorix.com/2012/05/17/hulk-web-server-dos-tool/ I just ported the code as is quick and dirty. Original functions names are keeped and original logic mostly keeped too. The main...

CVE-2026-88012

Traefik , the open-source HTTP reverse proxy and load balancer, has a flaw in how HTTP/3 entrypoints handle respondingTimeouts.readTimeout . The timeout is enforced at the TCP layer, but HTTP/3 operates over QUIC , which has no corresponding stream deadline. This means an unauthenticated attacker...

EUVD-2026-75428

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-88878 Traefik v2.8.2 through v3.6 HTTP/3 Timeout Bypass

Traefik is an HTTP reverse proxy and load balancer. In versions = v2.8.2 through = v3.0.0 through .transport.respondingTimeouts settings — notably readTimeout, which is enabled by default at 60s — are not applied to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying...

CVE-2026-23842-Denial-of-Service-via-Database-Connection-Pool-Exhaustion-version-1.2.10

CVE-2026-23842 Denial of Service via Database Connection Pool Exhaustion in ≤ 1.2.10 📌 Overview This repository documents my discovery and responsible disclosure of CVE-2026-23842 , a High Severity Denial-of-Service vulnerability in ChatterBot. GitHub Advisory: GHSA-v4w8-49pv-mf72 CVE ID:...

PT-2026-89473

Summary There is a medium severity vulnerability in Traefik's HTTP/3 entry points: the respondingTimeouts settings were not applied to the HTTP/3 request path. readTimeout in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, b...

PT-2026-89389

Summary There is a medium severity vulnerability in Traefik's HTTP/3 entry points: the respondingTimeouts settings were not applied to the HTTP/3 request path. readTimeout in particular is on by default at 60s and is documented as bounding the time to read the entire request including its body, b...

org.apache.httpcomponents.client5/httpclient5: Apache HttpComponents Client: Denial of Service due to connection leak

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

CVE-2026-64607

A flaw was found in Apache HttpComponents Client, specifically in its classic input/output I/O model. When processing a response message with an invalid or unsupported Content-Encoding header, the client fails to properly release the underlying network connection. This connection leak can lead to...

Astra Linux – Vulnerability in curl

A authentication bypass vulnerability exists in libcurl prior to v8.0.0. It reuses an previously established SSH connection, even though one SSH option has been modified, which should prevent such reuse. libcurl maintains a pool of previously used connections and can reuse them for subsequent...

CVE-2026-78321

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

CVE-2026-78321

The HTTP media server on multiple DJI drone models (including Neo, Flip, Air 3, Avata 2, Mavic 3, Mini 2–5 Pro, and others) lacks sufficient limits on incoming connections and request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeat...

CVE-2026-78321 DJI Drone HTTP Media Server Denial of Service via Connection Pool Exhaustion

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

EUVD-2026-64756

The HTTP media server on DJI drones does not enforce sufficient limits on incoming connections or request rates. An attacker with access to the drone's internal network can exhaust the server's connection pool by repeatedly requesting a stored media file, preventing the server from handling...

PT-2026-79839

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

c3p0: c3p0: Remote code execution via deserialization vulnerability

A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger...

JLSEC-2026-1199 libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse...

libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. An easy handle that first uses default native CA trust can continue trusting the native platform store after the application switches that same handle to custom CA...

CVE-2026-17603

Affected software : Nexus Repository 3. Vulnerable component : HikariCP connection pool via the DataStore configuration API, specifically the ability to set the connectionInitSql property. Root cause : insufficient restriction on which HikariCP properties can be configured through the DataStore A...

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Summary There is a critical vulnerability in Traefik's default HTTP reverse proxy that leads to unauthenticated cross-user response poisoning. When a client opens an HTTP/2 or HTTP/3 CONNECT request, Traefik forwards it — body included — to an HTTP/1.1 upstream over a shared net/http.Transport. I...

curl: CVE-2026-18924: HTTP/2 server push UAF

A vulnerability was discovered in libcurl versions 8.21.0 and later, where a use-after-free issue could occur in the HTTP/2 server push functionality. The vulnerability was caused by the fact that when a pushed transfer ends, the connection's pool is not properly handled, leading to the freed...