TID-The-Instant-Destroyer

TID — 即时销毁器 针对基于缓存的旁路攻击防护领域的独立安全研究。 概述 TID 是一种专用协议，旨在在使用后立即从 CPU 缓存层（$L1、L2$ 和 $L3$）中消除敏感数据残留（例如加密密钥）。它解决了数据在系统内存（RAM）中被擦除后仍存在于硬件结构中的关键安全漏洞。 主要成就 已验证的防御： 有效缓解 Flush+Reload 及类似的微架构旁路攻击。 可衡量的性能： 未受保护的访问： 78 CPU 周期（缓存命中）。 TID 保护的访问： 286 CPU 周期（缓存未命中）。 安全边际： 提供 3.7 倍延迟屏障 ，成功迷惑潜在攻击者。 硬件级精度： 利用优化的 CPU...

CVE-2026-69208

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47 , the DigestAuth server middleware contains an inverted stale-nonce comparison that removes fresh nonces and stops eviction at the first stale nonce. On any application protecting at least one route with DigestAuth, an ...

EUVD-2026-79289

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the first stale nonce because its stale-nonce comparison is inverted. On an application that protects at least one route with DigestAuth, an...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: vfs: Do not evict inode under the inode lru traversing context The inode reclaiming process see function pruneicachesb collects all reclaimable inodes and marks them with the IFREEING flag. At that time, other processes will b...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: lib/testhmm.c: Handling of failures in allocating srcpfns and dstpfns The kcalloc function used in dmirrordeviceevictchunk will return null if the physical memory runs out. As a result, if srcpfns or dstpfns is dereferenced, a...

CVE-2026-89321

Publishing limits the compressed size of a VSIX ovsx.publishing.max-content-size, 512 MB by default but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/namespace/extension/version/path, WebResourceService opened the entry with ZipFile.getInputStream a...

CVE-2026-55250

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

CVE-2026-55250

Maravel Framework (a PHP dependency-injection framework), prior to version 10.74.0 , is affected by a Token Replay Vulnerability (CVSS 8.7 HIGH). The root cause is a lifecycle mismatch: tymon/jwt-auth writes 14-day JWT blacklist entries into tagged cache, but Maravel's O(1) Atomic Lazy Eviction m...

CVE-2026-55250 Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Eviction in Tagged Caches

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. Any application with low...

GHSA-C83G-RGW3-J3CX Browserslist: Unbounded memory growth (no cache eviction) via distinct query results, leading to eventual OOM

Vulnerability Details File: index.js Location: cache browserslist's result cache, line 402 and parseCache parseQueries's AST cache Root Cause js var cache = var parseCache = function browserslistqueries, opts ... var cacheKey = JSON.stringifyqueries, context if cachecacheKey return cachecacheKey...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098952)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098952 advisory. In the Linux kernel, the following vulnerability has been resolved: apparmor: fix race between freeing data and fs accessing it AppArmor was putting the reference to...

CVE-2026-41707

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707 Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay

Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attackers to evict legitimate entries ...

CVE-2026-41707

Spring Security 's DPoPProofJwtDecoderFactory is vulnerable to a cache-based replay attack . The internal cache that stores JWT ID claims has a strict size limit, which an attacker can exploit by flooding the server with dummy requests to evict legitimate entries, then replaying intercepted valid...

PT-2026-81899

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Description An authentication bypass issue exists in the DPoPProofJwtDecoderFactory due to a cache-based replay attack. Th...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: jfs: fixed GPF in diFree Avoid passing an inode with JFSSBIinode-isb-ipimap == NULL to diFree1. GFP will be returned: struct inode ipimap = JFSSBIip-isb-ipimap; struct inomap imap = JFSIPipimap-iimap; JFSIP will return an...

Astra Linux – Vulnerability found in Linux 5.15, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: blk-crypto: made blkcryptoevictkey more robust. If blkcryptoevictkey determines that the key is still in use due to a bug or that -keyslotevict failed, it currently simply returns without unlinking the key from the keyslot...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: fscrypt: destroy keyring after securitysbdelete The function fscryptDestroykeyring must be called after all potentially-encrypted inodes have been evicted; otherwise, it cannot safely destroy the keyring. Since inodes that are...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Fuse: Fix for the deadlock caused by reclaimeduring. The commit e26ee4efbc79 “Fuse: Allocate ff-releaseargs only if release is needed” avoids allocating ff-releaseargs if the server does not implement open. However, in doing so,...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: AppArmor: Fixed the race condition between freeing data and accessing it through the file system. AppArmor originally placed a reference to private data after removing the original entry from the file system. However, the inode m...