CVE-2026-111103 HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError...

EEF-CVE-2026-111103 HTTP/2 StreamError recovery rolls back connection state and bypasses per-connection limits in Bandit

Summary Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises...

lmg

Linux Memory Grabber A script for dumping Linux memory and creating VolatilityTM profiles. Hal Pomeranz [email protected], 2020-02-01 THANKS! "If I have seen further it is by standing on the shoulders of giants." Issac Newton There are a lot of people who deserve thanks for making this simpl...

capsule

Getting Started • Documentation • Issues • Contributing Capsule is a runtime for executing untrusted code in isolated environments. Each task runs inside its own WebAssembly sandbox, providing: Isolated execution : Each task runs isolated from your host system Resource limits : Set CPU, memory, a...

domain

Info Recon-ng and Alt-DNS are awesome. This script combines the power of these tools with the ability to run multiple domains within the same session. TLDR; I just want to do my subdomain discovery via ONE command and be done with it. Only 1 module needs an api key /api/googlesite find instructio...

CVE-2022-41404-DoS-Protection

CVE-2022-41404-DoS-Protection Windows Apache Tomcat resource limits implementation guide for CVE-2022-41404 DoS vulnerability protection...

CVE-2023-44487

CVE-2023-44487 — HTTP/2 Rapid Reset Test Lab Educational environment for LTAT.04.022 Homework 4. Four containers let you scan and compare vulnerable vs. patched configurations. Port Map Container| Port| Software| Status ---|---|---|--- nginx-vuln| 8441| nginx 1.24| Vulnerable nginx-secure| 8442|...

CLEANSTART-2026-XM80593 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...

CVE-2026-115389

A flaw was found in Wasmtime. The runtime does not adequately account for host memory allocations when converting guest values through the dynamically-typed Val application programming interface API, bypassing configured resource consumption limits. A malicious WebAssembly guest can exploit this...

CLEANSTART-2026-WJ10248 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...

CLEANSTART-2026-JZ64698 RSA and DSA public key parsers did not enforce size limits on key parameters

Security vulnerability affects the argo-cd package. The RSA and DSA public key parsers did not enforce size limits on key parameters...

CVE-2026-115390

A flaw was found in Wasmtime. This vulnerability allows an untrusted guest program to cause a Denial of Service DoS by bypassing execution limits. Due to an accounting flaw in Cranelift-compiled execution paths, a guest can reset consumed execution units known as fuel after specific function call...

CVE-2026-96405

NLnet Labs Unbound up to and including version 1.26.1 limits compressi...

CVE-2026-94440

A flaw was found in the mime/multipart and net/textproto packages in Go. A remote attacker could exploit this vulnerability by submitting a crafted multipart form request that bypasses configured memory limits when the remaining boundary limit is small. This issue allows the application to read a...

CVE-2026-115398

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to...

CVE-2026-115397

Ghidra before 12.2 contains a resource allocation without limits vulnerability in ExtensionUtils.unzipToInstallationFolder that extracts every extension ZIP entry without limiting file count. Attackers who persuade a user to install a crafted extension archive with many files can exhaust filesyst...

CVE-2026-115395

Ghidra 10.3 before 12.2 contains a resource allocation without limits vulnerability in ThemeReader.readZipTheme that extracts unlimited theme ZIP entries to the images directory. Attackers can persuade users to import a crafted theme archive with many small files, exhausting inodes and disk space...

DEBIAN-CVE-2026-115380

Wasmtime before 36.0.17, 37.0.0 before 48.0.4, and 49.0.0 before 49.0.2 contains a denial of service vulnerability in the wasmtime-wasi WASI preview 0 polloneoff adapter, which performs On host work per subscription without consuming or checking fuel. Malicious guest modules can pass many...

EUVD-2026-108334

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to...

CVE-2026-115398 Ghidra before 12.2 Denial of Service via TAR and ZIP File System Mount

Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to...