fastjson-jsontype-rce-lab

Fastjson @JSONType remote-JAR/FD-chain lab and detection This repository now preserves two distinct Fastjson research tracks: modern-fd/ is the recommended, marker-only reconstruction of the Fastjson 1.2.83 single-body remote-JAR/file-descriptor chain on Spring Boot 3, normal embedded Tomcat and...

cve-2024-21626

CVE-2024-21626 Overview This repository contains code examples for an app vulnerable to CVE-2024-21626 as well as an eBPF gadget to detect exploitation attempts. This repoistory was created as part of this blog post. The gadget program used to detect this vulnerability is for demonstration purpos...

CVE-2022-2602-Kernel-Exploit

CVE-2022-2602-Kernel-Exploit Details https://blog.hacktivesecurity.com/index.php/2022/12/21/cve-2022-2602-dirtycred-file-exploitation-applied-on-an-iouring-uaf/ TL;DR The vulnerability is an Use-After-Free that impacts the registered file descriptor functionality in the iouring subsystem. It's...

CVE-2024-21626-runcPOC

Vulnerability Reproduction CVE-2024-21626 docker runc Escape Vulnerability 1. Vulnerability Overview Vulnerability Name| docker runc Escape Vulnerability ---|--- CVE ID| CVE-2024-21626 Disclosure Date| 2024-01-31 Characteristic| / Affected Versions| runc @ v1.0.0-rc93, 1.1.11 2. Exploitation &...

CVE-2026-107834

The OWASP Coraza WAF library (versions 3.0.0 through 3.8.0 ) is vulnerable to resource exhaustion due to improper file handle management in the internal/bodyprocessors/multipart.go component. The multipart loop executes defer temp.Close() for every uploaded file part, preventing descriptors from ...

CVE-2026-107834 OWASP Coraza WAF: Resource exhaustion via deferred file handle accumulation in multipart body processor

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the multipart loop in internal/bodyprocessors/multipart.go executes defer temp.Close for every uploaded file part, so each temporary-file descriptor remains open until the complete reques...

cve-2024-21626-runc-1.1.11-escape

CVE-2024-21626 - runc Leaky Vessels Overview Field| Detail ---|--- CVE| CVE-2024-21626 Affected Component| runc ≤ 1.1.11 Vulnerability Class| Container escape via file descriptor leak Nickname| Leaky Vessels Root Cause runc leaks an internal file descriptor typically fd/7 pointing to the host...

CVE-2024-21626-PoC

CVE-2024-21626 Root cause & Proof of Concept How to use poc-autoplay? make install make uninstall 1. Root cause In runc versions ≤ 1.1.11, when opening the host's /sys/fs/cgroup directory to set cgroups, the file descriptor is left open for the container initialization process without closing it,...

CVE-2024-21626-POC

CVE-2024-21626-POC 사용 설명 교육/연구 목적으로만 사용하십시오. 교육/연구와 무관한 행위로 발생하는 모든 위험은 사용자 본인이 책임집니다. 사용 docker build . -t cve-2024-21626 docker run -it --rm cve-2024-21626 bash /poc.sh 另起一个terminal /bin/bash.copy 주의 docker/runc 버전에 따라 사용되는 구체적인 파일 디스크립터가 다릅니다. 예를 들어 docker server:20.10.17 && runc version 1.1.2...

CVE-2026-106575

A flaw was found in ImageMagick. An attacker could provide a specially crafted Magick script that fails to release opened file pointers during execution. Repeated processing of such scripts can exhaust available file descriptors system resources used to manage open files, resulting in a Denial of...

CVE-2026-106575 ImageMagick: Unclosed file pointer in magick script

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...

CVE-2026-106575 ImageMagick: Unclosed file pointer in magick script

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...

Linux Distros Unpatched Vulnerability : CVE-2026-106575

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened fi...

CVE-2026-88252 Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion

A flaw was found in sssd. A local user can cause a Denial of Service DoS by exhausting the responder service's available file descriptors system handles used for open connections. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection...

CVE-2026-88252

A Denial of Service (DoS) vulnerability exists in sssd where a local user can exhaust the responder service's available file descriptors . By maintaining numerous concurrent connections to a responder socket and queuing new attempts, an attacker triggers an unthrottled retry loop . This results i...

CVE-2026-88252 Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion

A flaw was found in sssd. A local user can cause a Denial of Service DoS by exhausting the responder service's available file descriptors system handles used for open connections. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection...

dovecot: Dovecot: Denial of Service and potential message duplication via connection limit exhaustion

A flaw was found in the Dovecot mail server's submission-login component. This vulnerability occurs when the server reaches its maximum allowed user IP connections, leading to a crash due to file descriptor handling issues. This can result in a denial of service, preventing users from sending...

public-passwd

!WARNING Only use this on systems you own or have authorisation to test. It is recommended to keep a root shell open if you won't be able to reboot the system in case of failure, as you may not be able to clear the page cache for /etc/shadow without root. public-passwd Use CVE-2026-46333 and...

Rocky Linux 9.6 [TuxCare] Security Update: dbus-broker (ALMALINUX9.6:CLSA-2026:1791316945)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791316945 advisory. - A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably...

AlmaLinux 9.6 [TuxCare] Security Update: dbus-broker (ALMALINUX9.6:CLSA-2026:1791316945)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791316945 advisory. - A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup notably...