CLZero

CLZero 一个用于模糊测试 HTTP/1.1 CL.0 请求走私攻击向量的项目。 关于 感谢 @albinowax、@defparam 和 @d3d，否则这个工具不会存在。受工具 Smuggler 启发，所有攻击手法改编自 Smuggler 和 https://portswigger.net/research/how-to-turn-security-research-into-profit...

citrixmash_scanner

CVE-2019-19781 citrixmash 扫描器 一个用于检查易受 CVE-2019-19781 攻击的 Citrix 设备的多线程扫描器。 该扫描器不会尝试入侵/利用主机，并避免下载任何敏感内容。使用 HEAD 请求判断目标是否易受攻击。通过验证 Content-Length 响应头中的特定值来减少误报。 citrixmashscanner 既支持接收网络范围，也支持接收单个主机。 安装 root@kitploit: $ go get -u github.com/x1sec/citrixmashscanner 或者，可在 此处 获取适用于 Windows、Mac 和 Linu...

CVE-2026-54135

AirSane is a SANE frontend and scanner server supporting Apple's AirScan protocol. Versions prior to 0.4.12 are vulnerable to a remote, unauthenticated Denial of Service (OOM) in its custom HTTP server. The root cause lies in the HttpServer::Request::content function in httpserver.cpp, which read...

rewrite-cve-2026-22732

rewrite-cve-2026-22732 Receta de OpenRewrite que detecta código susceptible a CVE-2026-22732, un defecto de Spring Security donde establecer Content-Length a través de uno de tres métodos de respuesta omite el OnCommittedResponseWrapper de Spring Security. Debido a que el wrapper nunca ve la...

CVE-2019-19945_Test

CVE-2019-19945Test 这是第一个提议的 CVE 的代码。 1. 安装 Docker 2. 构建并运行服务器 cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve 3. 获取服务器容器的 IP Linux sudo docker container inspect server | grep -i IPAddress Windows Powershell docker container inspect server | Select-String...

Linux Distros Unpatched Vulnerability : CVE-2026-88045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed...

netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers

A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...

org.apache.activemq/activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-stomp: Apache ActiveMQ: Denial of Service via improper input validation in STOMP connector

A flaw was found in Apache ActiveMQ. A remote, unauthenticated attacker can exploit an improper input validation vulnerability by sending a specially crafted message with a negative content-length to an exposed STOMP connector. This can lead to a denial of service DoS condition, either by consumi...

CVE-2024-38828

CVE-2024-38828 漏洞 描述 该测试检查在存在与不存在 CVE-2024-38828 漏洞时 Spring Framework 的行为/反应。 在 ByteArrayHttpMessageConverter 中，会根据请求头 Content-Length 在 ByteArrayOutputStream 中分配内存，这可能与实际为 0 字节的请求体不符。当此类请求急剧增加时（DoS），内存使用效率低下，GC 清理频繁出现，应用开始卡顿。我将展示如何实现/修复以及相关指标。 漏洞描述 CVE-2024-38828 是 Spring Framework...

DEBIAN-CVE-2026-88045

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

CVE-2026-88045

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

org.apache.activemq/activemq: org.apache.activemq/activemq-all: org.apache.activemq/activemq-stomp: Apache ActiveMQ: Denial of Service via improper input validation in STOMP connector

A flaw was found in Apache ActiveMQ. A remote, unauthenticated attacker can exploit an improper input validation vulnerability by sending a specially crafted message with a negative content-length to an exposed STOMP connector. This can lead to a denial of service DoS condition, either by consumi...

EUVD-2026-75588

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

CVE-2026-88045

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

CVE-2026-88045

rclone (a CLI for syncing files across cloud storage) is affected by a memory exhaustion vulnerability in its S3 multipart streaming path (cmd/serve/s3/multipart.go). From v1.75.0 through v1.75.1 , an attacker-controlled Content-Length is passed to multipart.NewRW().Reserve before the request bod...

CVE-2026-88045 rclone: S3 multipart declared-length memory exhaustion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

CVE-2026-88045 rclone: S3 multipart declared-length memory exhaustion

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...

HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

SummaryHTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

PYSEC-2026-3849 HTTPX2: Conflicting Content-Length and Transfer-Encoding headers can be auto-generated

Summary HTTPX2 can automatically add a Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header. The resulting HTTP/1.1 request contains both framing headers, which can create an ambiguous message boundary and enable request smuggling or connection...

PT-2026-89501

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the serve S3 streamed multipart path in cmd/serve/s3/multipart.go passes attacker-controlled contentLength to multipart.NewRW.Reserve before reading request-body...