Envoy-CPU-Exhaustion-Vulnerability-PoC

Envoy CPU Exhaustion Vulnerability PoC This repository contains a proof-of-concept PoC Python script to demonstrate the CPU exhaustion vulnerability in Envoy caused by a flood of CONTINUATION frames. Author: blackmagic 2024 Description Envoy is a cloud-native, open-source edge and service proxy...

EUVD-2026-86477

Uncontrolled Resource Consumption CWE-400 / CWE-407 in the ANTLR 3 search query parser QueryParser / Query.g in Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 allows an unauthenticated remote attacker or an authenticated user if anonymous read...

CVE-2026-87721

Gerrit Code Review versions 2.0.19 through 3.12.9, 3.13.0 through 3.13.8, and 3.14.0 through 3.14.2 are vulnerable to Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g ). An unauthenticated remote attacker can trigger a persistent deni...

phpstress

phpstress Prueba de concepto de Night Lion Security de denegación de servicio / probador de estrés para sitios web PHP que se ejecutan en sistemas Apache y NGINX PHP-FPM y PHP-CGI Usando una conexión estándar de cable/DSL, este ataque puede inundar la CPU y RAM de un servidor web Linux usando...

io.netty/netty-codec-xml: Netty: Denial of Service via CPU Exhaustion in XmlFrameDecoder

A flaw was found in Netty's XmlFrameDecoder component. An unauthenticated remote attacker could send specially crafted XML closing-tag sequences. This could cause the system to repeatedly rescan accumulated data, leading to high CPU utilization and a denial of service DoS...

CVE-2026-61816

The zbateson/mail-mime-parser library is vulnerable to an uncontrolled resource consumption (CWE-400) vulnerability in versions 2.0.0 and prior to 3.0.6 and 4.0.2. Due to three independent parsing paths being super-linear in cost , a crafted email under 2 MB can consume significant CPU time or co...

CVE-2026-23869-Exploit

⚡ CVE-2026-23869 — React2DoS Denegación de Servicio Remota No Autenticada mediante el Protocolo Flight de React Agotamiento Cuadrático de CPU en la Deserialización de Mapas de Server Components Resumen • Cómo Funciona • Herramientas • Instalación • Uso • Nuclei • Solución • Aviso Legal Resumen de...

golang-CVE-2023-44487

Golang CVE-2023-44487 testing This repository contains testing resources and results for the CVE-2023-44487. It uses a modified version of https://github.com/secengjeff/rapidresetclient to test against various Golang server configs. Testing against a normal server root@kitploit: go run server.go ...

elysia has Inefficient Algorithmic Complexity and Interpretation Conflict

Elysia v1.4.28 is vulnerable to denial-of-service attacks due to CPU exhaustion in the form data normalization code. Elysia uses getAll to retrieve value from FormData. It is called directly relative to the total number of key-value pairs in the form data. The total amount of work the for loop ha...

Jawn: Quadratic parsing effort in AsyncParser

AsyncParser can be forced to perform On^2 work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start. Impact Denial of service via CPU exhaustion when parsing untrusted JSON. Preconditions: - Application...

CVE-2026-66074

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

CVE-2026-66074

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

CVE-2026-66074 RabbitMQ: ReDoS via management API ?name= filter

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

CVE-2026-66074 RabbitMQ: ReDoS via management API ?name= filter

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, matchvalue/3 passes the user-supplied ?name= regular expression to re:run with no matchlimit option, and executes it once per resource in the result set. OTP's default 10M matchlimit caps ea...

CVE-2026-77423

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

CVE-2026-77423 JLine: ReDoS in Built-in Less Viewer Search

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

CVE-2026-77423 JLine: ReDoS in Built-in Less Viewer Search

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPatternboolean doDisplayPattern in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's...

CVE-2026-77420 JLine: ReDoS via `HISTORY_IGNORE` Configuration Variable

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatternsString patterns, String line in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORYIGNORE configuration value into a Java regular expression...

CVE-2026-77421 JLine: ReDoS in Nano Editor Regex Search Mode

JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in nano editor's regex search mode passes a user-controlled search term from doSearchString text in builtins/src/main/java/org/jline/builtins/Nano.java to Java's backtracking regular expression...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in js-yaml (CVE-2026-53550)

Summary A Denial of Service vulnerability in the js-yaml document parsing library CVE-2026-53550 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 4.3.1. Vulnerability Details CVEID:CVE-2026-53550 DESCRIPTION: js-yaml is a JavaScript YAML parser...