EUVD-2026-125050

actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotli or zstd request bodies to Json, Form...

CVE-2026-128242

The actix-http (before 3.20.1) and actix-web (before 4.18.2) libraries contain an unbounded decompression vulnerability in the encoding::Decoder component. A remote attacker can trigger a Denial of Service (DoS) by sending small, highly compressed request bodies using gzip, deflate, Brotli, or zs...

dnsteal

dnsteal v 2.0 This is a fake DNS server that allows you to stealthily extract files from a victim machine through DNS requests. Below are a couple of different images showing examples of multiple file transfer and single verbose file transfer: Support for multiple files Gzip compression supported...

xencrypt

Xencrypt PowerShell crypter v 1.0 Authors Xentropy @SamuelAnttila SecForce @SECFORCELTD If you want to read about the design behind this tool and how to make your own crypter, there's an article I wrote about it here: Write a crypter in any language Note Don't be a script kiddie, I made this GPLv...

Swego

Swego Swiss army knife Webserver in Golang. Keep simple like the python SimpleHTTPServer but with many features Usage Run the binary If you don't want to build it, binaries are availables on https://github.com/nodauf/Swego/releases Otherwise, build-essential should be installed and GOPATH...

decoder-plus-plus

Decoder++ Decoder++ is an extensible application designed for penetration testers, software developers, and anyone in between looking to effortlessly decode and encode data across various formats. It includes a wide range of preinstalled scripts and codecs, smart decoding and format identificatio...

Imperva_gzip_WAF_Bypass

Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...

CVE-2026-124738

A flaw was found in BusyBox. When the HTTP daemon httpd has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file pat...

CVE-2026-20660

CVE-2026-20660 PoC Bundle This folder packages a standalone proof-of-concept for: CVE-2026-20660 CFNetwork NSGZipDecoder path traversal via gzip FNAME Impact on vulnerable macOS Safari with auto-open enabled 1. Directory Layout server.py: Main PoC server with configurable traversal depth and...

Powshell-decode-payload

decode powershell gzip code sal a New-Object;a IO.StreamReadera IO.Compression.GZipStreamIO.MemoryStreamConvert::FromBase64String'xxxx',IO.Compression.CompressionMode::Decompress,Text.Encoding::ASCII.ReadToEnd sal a New-Object;a IO.StreamReadera...

CVE-2026-124738

A flaw in BusyBox allows a remote attacker to bypass password rules for pre-compressed .gz files when the HTTP daemon (httpd) has pre-compressed file support enabled. The vulnerability occurs because authentication checks are evaluated against the requested URL path instead of the actual pre-comp...

Important: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption

A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...

Important: Red Hat Security Advisory: python-tornado security update

An update for python-tornado is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption

A flaw was found in Tornado, a Python web framework and asynchronous networking library. Its gzip decompression routines process data in limited-size chunks but do not enforce an overall limit on the total accumulated decompressed data. This vulnerability allows a malicious server to consume...

FreeBSD : p5-Furl -- memory exhaustion vulnerability (7f156776-dd09-11f1-97dc-40b034429ecf)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7f156776-dd09-11f1-97dc-40b034429ecf advisory. Furl project reports: Fix memory exhaustion via unbounded decompression of gzip/deflate responses, a.k....

RHEL 9 : python-tornado (RHSA-2026:98106)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:98106 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

RHEL 9 : python-tornado (RHSA-2026:98107)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:98107 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

CVE-2026-124738: Red Hat: A flaw was found in BusyBox

A flaw was found in BusyBox. When the HTTP daemon httpd has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file pat...

Imperva_gzip_bypass

Imperva Web Application Firewall WAF POST Request Bypass Imperva Cloud WAF was vulnerable to a bypass that allows attackers to evade WAF rules when sending malicious HTTP POST payloads, such as log4j exploits, SQL injection, command execution, directory traversal, XXE, etc. Remediation The Imperv...