13 matches found
CVE-2026-104436
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain...
CVE-2026-104436 Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain...
CVE-2026-104436 Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain...
CVE-2026-104436 Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain...
CVE-2026-104436: Allocation of Resources Without Limits or Throttling
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain...
GHSA-4HQW-QXG8-JXX2 Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
Summary Axios contains a guard in the Node HTTP adapter to avoid using an inherited Object.prototype.getHeaders as a FormData header source. The fetch adapter calls the shared resolveConfig helper before dispatch, and that helper lacks the same guard. If another vulnerability pollutes...
NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders
NPM: Axios: Fetch Adapter Header Injection via Inherited FormData getHeaders vulnerability discovered by ? in WordPress Npm axios versions = 1.12.0, 1.20.0...
Use of Less Trusted Source
Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Use of Less Trusted Source through the getHeaders processing in the AWS API Gateway v1 EventV1Processor and the Lattice LatticeV2Processor. An attacker can cause a repeate...
GHSA-443G-GWGP-49X4 zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections. Summary The readgetblocks and readgetheaders codec paths accepted block locator vectors up to approximately 65,535 entries the generic TrustedPreallocate ceiling derived...
zebrad vulnerable to getblocks/getheaders locator CPU amplification via uncapped vector length
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections. Summary The readgetblocks and readgetheaders codec paths accepted block locator vectors up to approximately 65,535 entries the generic TrustedPreallocate ceiling derived...
PT-2026-57590
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node accepts inbound P2P connections. Summary The read getblocks and read getheaders codec paths accepted block locator vectors up to approximately 65,535 entries the generic TrustedPreallocate ceiling derive...
Axios: Header Injection via Prototype Pollution
Summary A prototype pollution gadget exists in the Axios HTTP adapter lib/adapters/http.js that allows an attacker to inject arbitrary HTTP headers into outgoing requests. The vulnerability exploits duck-type checking of the data payload, where if Object.prototype is polluted with getHeaders,...
PHP getheaders() Unauthenticated Access
The vulnerability of the getheaders function implementation in the PHP programming language is related to insufficient validation of input data when processing links using the \0 symbol. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to...