hulk

Hulk DoS tool HULK DoS tool ported to Go language from Python. Original Python utility by Barry Shteiman http://www.sectorix.com/2012/05/17/hulk-web-server-dos-tool/ I just ported the code as is quick and dirty. Original functions names are keeped and original logic mostly keeped too. The main...

CVE-2026-23842-Denial-of-Service-via-Database-Connection-Pool-Exhaustion-version-1.2.10

CVE-2026-23842 Denial of Service via Database Connection Pool Exhaustion in ≤ 1.2.10 📌 Overview This repository documents my discovery and responsible disclosure of CVE-2026-23842 , a High Severity Denial-of-Service vulnerability in ChatterBot. GitHub Advisory: GHSA-v4w8-49pv-mf72 CVE ID:...

UBUNTU-CVE-2026-123588

The recursive resolver in Hickory DNS all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2 caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS...

CVE-2026-123588

The recursive resolver in Hickory DNS all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2 caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS...

DEBIAN-CVE-2026-123588

The recursive resolver in Hickory DNS all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2 caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS...

CVE-2026-123588 Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool

The recursive resolver in Hickory DNS all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2 caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS...

CVE-2026-123588 Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Pool

The recursive resolver in Hickory DNS all versions of the hickory-recursor crate, and hickory-resolver 0.26.0 before 0.26.2 caches an empty connection pool when it follows a referral with no glue records and all queries for the name servers' IP addresses fail. An attacker able to spoof DNS...

CVE-2026-123588

The Hickory DNS recursive resolver is vulnerable to a Denial of Service (DoS) attack via a cached empty connection pool . Specifically, all versions of the hickory-recursor crate and hickory-resolver versions 0.26.0 before 0.26.2 are affected. The issue occurs when the resolver follows a referral...

SUSE CVE-2026-121966

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...

CVE-2026-114639

A flaw was found in Traefik. When a user authenticates to a backend service using an HTTP Negotiate authorization token, Traefik places the authenticated connection into a globally shared connection pool without isolating it. A remote, unauthenticated attacker connecting on a separate session can...

CVE-2026-121966

Traefik versions 2.x before 2.11.60 and 3.x before 3.7.16 are vulnerable to an identity leak during ForwardAuth and Ingress NGINX auth-url requests. The root cause is that these subrequests are sent through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Ne...

CVE-2026-121966 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...

CVE-2026-121966 Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak

Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests and, in 3.7, Ingress NGINX auth-url requests through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user'...

PT-2026-137018

Name of the Vulnerable Software and Affected Versions Traefik versions 2.x through 2.11.59 Traefik versions 3.x through 3.7.15 Description ForwardAuth subrequests and Ingress NGINX auth-url requests are sent through an auth-server connection pool shared by all clients. This behavior exposes...

CVE-2026-107281

A flaw was found in AsyncHttpClient. When connection-oriented authentication mechanisms, such as NT LAN Manager NTLM or Negotiate, are used, the HTTP connection pool does not account for the authenticated user identity. Consequently, a connection authenticated by one user can be reused by request...

CVE-2026-119179 MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data

A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that...

CVE-2026-119179

A flaw in the connection management layer of the MongoDB Node.js driver allows for connection pool desynchronization after an operation timeout occurs. When the optional client-side operation timeout is enabled, a pooled network connection might be returned for reuse while data from a previous op...

MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data

A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that...

Uncontrolled Resource Consumption

org.asynchttpclient, async-http-client is vulnerable to uncontrolled resource consumption. The vulnerability is due to connection permits not being released when TLS connection establishment fails, which allows an attacker to trigger repeated connection failures and exhaust the available connecti...

EUVD-2026-109971

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...