CVE-2026-23842-Denial-of-Service-via-Database-Connection-Pool-Exhaustion-version-1.2.10

CVE-2026-23842 Denial of Service via Database Connection Pool Exhaustion in ≤ 1.2.10 📌 Overview This repository documents my discovery and responsible disclosure of CVE-2026-23842 , a High Severity Denial-of-Service vulnerability in ChatterBot. GitHub Advisory: GHSA-v4w8-49pv-mf72 CVE ID:...

hulk

Hulk DoS tool HULK DoS tool ported to Go language from Python. Original Python utility by Barry Shteiman http://www.sectorix.com/2012/05/17/hulk-web-server-dos-tool/ I just ported the code as is quick and dirty. Original functions names are keeped and original logic mostly keeped too. The main...

EUVD-2026-109971

The Bluetooth host pre-allocates a btconn object a "reservation" from the fixed aclconns pool for every connectable advertising set it starts, in leadvstartaddconn in subsys/bluetooth/host/adv.c. When an incoming peripheral connection completes, findpendingconnect in subsys/bluetooth/host/hcicore...

SUSE CVE-2026-114639

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on...

CVE-2026-114637

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend...

CVE-2026-114639

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on...

CVE-2026-114639 Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on...

EUVD-2026-107894

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on...

CVE-2026-114639 Traefik before 2.11.58 and 3.7.14 Authentication Bypass via Negotiate Connection Pool

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on...

CVE-2026-114639

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backend connection pool, which is never isolated. Unauthenticated attackers on...

CVE-2026-114639

Traefik versions 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 are vulnerable to an authentication bypass in the Negotiate connection pool . The root cause is that a first request using an Authorization: Negotiate token authenticates a socket within a globally shared backend connection pool that ...

CVE-2026-114637

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend connection. Unauthenticated clients can be handed a pooled keep-alive backend...

PT-2026-120932

Name of the Vulnerable Software and Affected Versions Traefik versions 3.2.0 through 3.7.13 Description An authentication bypass exists in the experimental FastProxy connection pool. The system fails to pin NTLM or Negotiate-authenticated backend connections to their corresponding frontend...

PT-2026-120934

Name of the Vulnerable Software and Affected Versions Traefik versions 2.11.0 through 2.11.57 Traefik versions 3.0.0 through 3.7.13 Description An authentication bypass exists due to the lack of isolation in the globally shared backend connection pool. When a request is preauthenticated using an...

Traefik Labs Traefik authorization issue vulnerability

Traefik Labs Traefik versions from 2.11.0 up to 2.11.58 and from 3.0.0 up to 3.7.14 contain an authorization issue vulnerability. This vulnerability arises because the first request using Authorization: Negotiate for pre-authentication attempts to authenticate against a global shared backend...

SUSE CVE-2026-111065

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. An attacker can consequently exhaust the connection pool temporarily until garbage collection resolves the connections. This issue is fix...

EUVD-2026-104481

AIOHTTP: Connector pool exhaustion via Max-Age overflow...

GHSA-6CJC-53GC-5RQM AIOHTTP: Connector pool exhaustion via Max-Age overflow

Summary An overflow in Max-Age processing can skip closing a connection. Impact An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections...

AIOHTTP: Connector pool exhaustion via Max-Age overflow

Summary An overflow in Max-Age processing can skip closing a connection. Impact An attacker may be able to exhaust the connection pool temporarily, until garbage collection resolves the connections...

Linux Distros Unpatched Vulnerability : CVE-2026-111065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Max-Age processing can overflow and skip closing a connection. ...