CVE-2026-88252 Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion

A flaw was found in sssd. A local user can cause a Denial of Service DoS by exhausting the responder service's available file descriptors system handles used for open connections. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection...

CVE-2026-88252

A Denial of Service (DoS) vulnerability exists in sssd where a local user can exhaust the responder service's available file descriptors . By maintaining numerous concurrent connections to a responder socket and queuing new attempts, an attacker triggers an unthrottled retry loop . This results i...

dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion

A flaw was found in the Dovecot mail server's submission-login component. This vulnerability occurs when the server reaches its maximum allowed user IP connections, leading to a crash due to file descriptor handling issues. This can result in a denial of service, preventing users from sending...

public-passwd

!WARNING Only use this on systems you own or have authorisation to test. It is recommended to keep a root shell open if you won't be able to reboot the system in case of failure, as you may not be able to clear the page cache for /etc/shadow without root. public-passwd Use CVE-2026-46333 and...

fastjson-jsontype-rce-lab

Fastjson @JSONType remote-JAR/FD-chain lab and detection This repository now preserves two distinct Fastjson research tracks: modern-fd/ is the recommended, marker-only reconstruction of the Fastjson 1.2.83 single-body remote-JAR/file-descriptor chain on Spring Boot 3, normal embedded Tomcat and...

EUVD-2026-93205

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

cve-2024-21626

CVE-2024-21626 Overview This repository contains code examples for an app vulnerable to CVE-2024-21626 as well as an eBPF gadget to detect exploitation attempts. This repoistory was created as part of this blog post. The gadget program used to detect this vulnerability is for demonstration purpos...

CVE-2022-2602-Kernel-Exploit

CVE-2022-2602-Kernel-Exploit Details https://blog.hacktivesecurity.com/index.php/2022/12/21/cve-2022-2602-dirtycred-file-exploitation-applied-on-an-iouring-uaf/ TL;DR The vulnerability is an Use-After-Free that impacts the registered file descriptor functionality in the iouring subsystem. It's...

kernel-c-to-rust-spike

Kernel C-to-Rust hardening spike: UVC descriptor parser Can a security-critical Linux kernel C parser be hardened by rewriting it in Rust, with the rewrite shown equivalent to the original and then formally verified? This spike runs the full loop on one target: the UVC video descriptor parser...

CVE-2019-1253

CVE-2019-1253 AppXSvc Arbitrary File Security Descriptor Overwrite EoP I have independently reported this vulnerability to MSRC, however, my submission turned out to be a duplicate due to the fact that the fix for CVE-2019-1253 also addressed this issue. My PoC differs from the ones created by...

CVE-2024-21626-old-docker-versions

Container escape vulnerability in old runc components CVE-2024-21626 During my analysis about CVE-2024-21626 I found that other older docker components are vulnerable about fd leakage that is not mentioned in the security advisory GHSA-xr7r-f8xq-vfvv. Read my full article for detailed explanation...

CVE-2024-21626-runcPOC

Vulnerability Reproduction CVE-2024-21626 docker runc Escape Vulnerability 1. Vulnerability Overview Vulnerability Name| docker runc Escape Vulnerability ---|--- CVE ID| CVE-2024-21626 Disclosure Date| 2024-01-31 Characteristic| / Affected Versions| runc @ v1.0.0-rc93, 1.1.11 2. Exploitation &...

ptrace_may_dream

ptracemaydream CVE-2026-46333 Local privilege escalation exploit for the ptracemayaccess mm=NULL race condition in pidfdgetfd2. When a process is dying and its mm has already been released, the kernel skips the ptrace access check entirely. By racing pidfdgetfd against process exit, an unprivileg...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that initiated the operation. That pointer will be used when the device is completed—which could happen at any time ...

docker_lightman_exploit

Docker Lightman Exploit Docker CVE-2022-37708. This exploit relies on how the UNIX filesystem has UID and GID on files that Docker shares between the Host running the Docker and the Client being run within the Docker as well as relies on the nature of how Process ID ownership works. The Problem i...

CVE-2024-21626-POC

CVE-2024-21626-PoC Usage Instructions For educational/research purposes only. Any use unrelated to education/research is at your own risk. Usage docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy Note The specific file descriptors used var...

CVE-2025-1974

Exploit for Ingress NGINX - IngressNightmare This project provides an exploit targeting critical unauthenticated Remote Code Execution RCE vulnerabilities in the Ingress NGINX Controller for Kubernetes, collectively referred to as IngressNightmare. In the original research, the Wiz team did not...

cve-2024-21626-runc-1.1.11-escape

CVE-2024-21626 - runc Leaky Vessels Overview Field| Detail ---|--- CVE| CVE-2024-21626 Affected Component| runc ≤ 1.1.11 Vulnerability Class| Container escape via file descriptor leak Nickname| Leaky Vessels Root Cause runc leaks an internal file descriptor typically fd/7 pointing to the host...

CVE-2026-31431

copy.fail — AFALG AEAD splice primitive CVE-2026-31431 Overview This project is a C port of the original Python prototype, by offsecguy. It leverages the Linux kernel crypto API AFALG using: authencesnhmacsha256,cbcaes AEAD mode MSGMORE flag splice system call The technique feeds data from a...

CVE-2026-22013-Hardware-Wallet-USB-Descriptor-Buffer-Overflow

CVE-2026-22013 – Hardware Wallet USB Descriptor Buffer Overflow Program Code C firmware sim // hwwalletusb.c - USB descriptor parsing with fixed buffer include void handleusbsetupchar data, int len char descriptor32; if len 0 && data0 == 0x06 // GETDESCRIPTOR // Copy descriptor payload without...