POC-CVE-2025-48988-CVE-2025-48976

CVE-2025-48988 & CVE-2025-48976 About This project runs a simple file upload endpoint with Tomcat 10.1.41 and a Jakarta Servlet. The exploit runs, by default, 1000 parallelized multipart requests with 1000 parts and 50 headers by part, from 50 workers. Run POC Build and run the Docker container:...

CVE-2025-26466-msf

CVE-2025-26466 Metasploit module OpenSSH versions 9.5p1 to 9.9p1 is vulnerable to a memory and CPU exhaustion DoS Attack by sending repeated SSH2MSGPING packets type 192. This occurs before authentication, and can result in server lockup due to poor queue/buffer handling. More information about...

DHEater

DHEater DHEater is the proof-of-concept implementation of the DHEat attack CVE-2002-20001. It saturates a server's CPU by enforcing Diffie-Hellman ephemeral DHE or elliptic-curve Diffie-Hellman ephemeral ECDHE key exchange over both TLS and SSH. For further information about the attack visit the...

CVE-2022-0778

CVE-2022-0778 Description We refer to the concept of drago-96 and then rewrite a PoC based on the P12 and PEM format. You can use it to verify the CVE-2022-0778 vulns, i.e., a dangerous SSL certificate without any private password, leave it empty. If the device is affected, it may cause the CPU o...

Envoy-CPU-Exhaustion-Vulnerability-PoC

Envoy CPU Exhaustion Vulnerability PoC This repository contains a proof-of-concept PoC Python script to demonstrate the CPU exhaustion vulnerability in Envoy caused by a flood of CONTINUATION frames. Author: blackmagic 2024 Description Envoy is a cloud-native, open-source edge and service proxy...

golang-CVE-2023-44487

Golang CVE-2023-44487 testing This repository contains testing resources and results for the CVE-2023-44487. It uses a modified version of https://github.com/secengjeff/rapidresetclient to test against various Golang server configs. Testing against a normal server go run server.go go run...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS Unauthenticated Remote Denial-of-Service via React Flight Protocol Quadratic CPU Exhaustion in Server Components Map Deserialization Overview • How It Works • Tools • Install • Usage • Nuclei • Fix • Disclaimer Vulnerability Overview Field| Detail ---|--- CVE ID|...

phpstress

phpstress Night Lion Security proof of concept denial of service / stress tester for PHP websites running with Apache and NGINX systems PHP-FPM and PHP-CGI Using a standard cable/DSL connection, this attack can flood a Linux web server’s CPU and RAM using standard HTTP requests. This attack effec...

Wordpress-DOS-Attack-CVE-2018-6389

Wordpress-DOS-Attack-CVE-2018-6389 Load-scripts.php file, which purpose is to retrieve several JavaScript packages through one single request. $ chmod +x Execute.sh $ ./Execute.sh How it Works! The problem lies upon the load-scripts.php file, which purpose is to retrieve several Javascript packag...

openssh_dos

Since OpenSSH servers don't restrict the login password length, you can cause these servers to crash by sending very long passwords which use massive amounts of a the server's CPU to hash. This vulnerability is known as CVE-2016-6515. My POC can be downloaded here you will need to unzip Usage:...

CVE-2026-113877

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. languagematch interpolates each Accept-Language range into the pattern /^$range-/i without escaping it, so regular expression syntax in the header reaches the...

CVE-2026-113877 HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. languagematch interpolates each Accept-Language range into the pattern /^$range-/i without escaping it, so regular expression syntax in the header reaches the...

CVE-2026-113877

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. languagematch interpolates each Accept-Language range into the pattern /^$range-/i without escaping it, so regular expression syntax in the header reaches the...

EUVD-2026-109147

HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exhaustion via Accept-Language ranges matched as regular expressions. languagematch interpolates each Accept-Language range into the pattern /^$range-/i without escaping it, so regular expression syntax in the header reaches the...

CVE-2026-113877

The HTTP::Headers::ActionPack module for Perl (versions before 0.10 ) is vulnerable to CPU exhaustion via the Accept-Language header. The root cause is that the _language_match function interpolates ranges into a regular expression pattern without proper escaping, allowing attackers to inject com...

EUVD-2026-108646

jwkFields.CheckConsistency detected duplicate keyops entries with a pairwise nested loop, making validation cost grow with the square of the entry count. Because the check runs on every JWK and JWKS unmarshal, a modestly sized but hostile JWKS document could occupy a CPU core for many seconds...

CVE-2026-75507

A flaw was found in GraphQL-core. An unauthenticated remote attacker could cause a Denial of Service DoS by submitting a specially crafted query with nested inline fragments. During query validation, repeated field comparisons consume excessive CPU resources before complexity limits can be...

EUVD-2026-108421

Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '' characters. Attackers can send small markdown payloads that trigger ON^2 parselinktext and parselinklabel...

net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames

A flaw was found in the Go net/http package. This flaw allows a remote attacker to cause a Denial of Service DoS by triggering excessive CPU consumption on an affected client or server. By opening a large number of HTTP/2 streams and repeatedly sending small configuration SETTINGS frames that...

CVE-2026-108359 PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::processTableRow in src/PhpSpreadsheet/Reader/Ods.php accepts an unbounded table:number-rows-repeated attribute from an ODS table row. When the row contains a...