CVE-2022-20494

CVE-2022-20494 下载为APK 此应用演示了我发现的一个Android系统NotificationManagerService中的高严重性永久拒绝服务漏洞。运行利用程序后，设备将显示黑屏，或持续反复崩溃并重启。 该漏洞利用addAutomaticZenRule API通过精心构造恶意免打扰规则（即勿扰模式规则）以占用大量内存，从而耗尽设备内存。应用允许你控制添加规则的大小和数量：预设的数量应在绝大多数设备上生效。 该应用针对API 24（Android 7.0 Nougat），但由于免打扰规则结构的变更，在Android...

CVE-2024-38828

CVE-2024-38828 漏洞 描述 该测试检查在存在与不存在 CVE-2024-38828 漏洞时 Spring Framework 的行为/反应。 在 ByteArrayHttpMessageConverter 中，会根据请求头 Content-Length 在 ByteArrayOutputStream 中分配内存，这可能与实际为 0 字节的请求体不符。当此类请求急剧增加时（DoS），内存使用效率低下，GC 清理频繁出现，应用开始卡顿。我将展示如何实现/修复以及相关指标。 漏洞描述 CVE-2024-38828 是 Spring Framework...

http2-bomb-analysis-paper

HTTP/2 炸弹：HPACK 索引引用放大链攻击 一名高中生的独立技术深度剖析 2026年6月 TL;DR 本仓库包含我对 HTTP/2 炸弹 漏洞（CVE-2026-49975 / CVE-2026-47774）的完整分析，该漏洞将两个存在二十年的 HTTP/2 原语链接在一起： HPACK 索引引用放大 – 发送数千个单字节引用指向一个近乎空的动态表条目 流控窗口停滞 – 零初始窗口加上周期性1字节 WINDOWUPDATE 永久锁定内存 结果： 一条 100 Mbps 的客户端连接可在短短 10 秒内 耗尽 32 GB 服务器内存 。 🧠 我是如何入坑的 一切始于我在...

CVE-2026-67183-Unauthenticated-Memory-Leak-Leads-To-Memory-Exhaustion-TinyWeb-

Aviso de seguridad: Una fuga de memoria sin autenticación provoca el agotamiento de la memoria TinyWeb Identificador CVE asignado: CVE-2026-67183 Resumen TinyWeb asigna varios objetos al analizar cada solicitud y nunca los libera. Las estructuras de solicitud y de cabeceras no tienen destructores...

http2-bomb

Bomba HTTP/2 — CVE-2026-49975 PoC de Amplificación de Streams HTTP/2 · Docker · Consola Web Vulnerabilidad HTTP/2 permite multiplexar múltiples streams sobre una única conexión TCP. Este PoC construye tramas HEADERS especialmente formadas que contienen un gran número de referencias internas,...

dir-3040_dos

dir-3040 拒绝服务 Dir-3060 也可能受影响，因为它们共享来自同一固件的许多组件。 已在最新固件 1.20b03a 热修复版上测试。 FTP 服务器用户访问页面默认配置为允许任何具有写入权限的用户直接写入 RAM，而非仅限制写入 USB 驱动器。 在此问题的固件最新版本中，没有进行越界或缓冲区溢出检查。 写入（填满）可用内存后，系统将崩溃并重启。 用户无需管理员权限即可执行攻击。 以下为带有图片的详细概念验证。 曾联系 D-Link，但他们因无法复现该问题而强烈否认存在该漏洞。其他不合逻辑的解决方案已被我拒绝。 显示新用户的默认配置 检查 syslog 中的可用内存 使用 ...

kexkill

kexkill 工具连接到 SSH 服务器并发送一串 KEXINIT 包。这可能导致某些版本的 OpenSSH 消耗大量内存。更多细节请参见 CVE-2016-8858。 最新版本的源代码可在 Github 上获取： https://github.com/dag-erling/kexkill Bug 可在 Github 上提交 issue： https://github.com/dag-erling/kexkill/issues...

CVE-2025-31650

TomcatKiller - CVE-2025-31650 🚨 Apache Tomcat HTTP/2 DoS 漏洞 CVE-2025-31650 的概念验证 PoC 该脚本通过发送畸形的 priority 标头（通过 HTTP/2）来触发 Apache Tomcat 的内存耗尽条件。 🎯 受影响版本 Apache Tomcat 9.0.76 – 9.0.102 Apache Tomcat 10.1.10 – 10.1.39 Apache Tomcat 11.0.0-M2 – 11.0.5 ⚙️ 功能特性 ✔️ HTTP/2 支持验证 ✔️ Server 标头检查（检测 Tomcat）...

Wallbreak

Wallbreak Download as APK This app demonstrates two high severity permanent denial-of-service vulnerabilities in Android's WallpaperManagerService that I discovered: CVE-2021-39670 and CVE-2021-39690. After running either exploit, the device will keep repeatedly crashing and rebooting. Write-up...

CVE-2025-67445

概述 TOTOLINK X5000R V9.1.0cu.2415 的 Web 管理接口存在一个漏洞，允许 LAN 上的未经认证的远程攻击者通过段错误使 Web 服务崩溃。攻击者向 CGI 端点发送过大的 HTTP POST 请求，可触发内存耗尽，导致拒绝服务（DoS）。 漏洞详情 该漏洞源于固件 Lighttpd 配置中未对请求大小进行限制。具体而言，以下限制被注释掉了： root@kitploit: server.max-request-size = 16384 由于此限制未生效，CGI 端点 /cgi-bin/cstecgi.cgi 可接收极大请求体。根据固件反编译结果，CGI...

CVE-2026-84890

A flaw was found in undici. The decompress interceptor in undici processes compressed response bodies based on the untrusted Content-Encoding header. A remote attacker can exploit this by sending a small, specially crafted compressed payload, known as a 'compression bomb,' which expands...

CVE-2026-84890

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-18149

undici 's RetryHandler can leave an already-exposed response body orphaned when a server sends a partial body with a declared Content-Length, closes the connection, and the retry returns a non-retryable status (e.g., 400). The original body stream is neither ended nor destroyed, so reads on it ne...

CVE-2026-80892

CVE-2026-80892 affects the Linux kernel's EROFS filesystem driver (fs/erofs/decompressor_lzma.c). When the lzma_streams module parameter is unset, the global MicroLZMA stream pool is sized from num_possible_cpus() , and each stream preallocates an image-supplied dictionary of up to 8 MiB . On hig...

EUVD-2026-71642

In the Linux kernel, the following vulnerability has been resolved: erofs: cap LZMA stream pool size fs/erofs/decompressorlzma.c sizes the module-global MicroLZMA stream pool from numpossiblecpus when the lzmastreams module parameter is unset, then zerofsloadlzmaconfig preallocates one...

CVE-2026-84890

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-84890

undici , the Node.js HTTP client, is vulnerable to a denial of service via unbounded decompression of compressed responses. The decompress interceptor processes response bodies based on the untrusted Content-Encoding header. Although the number of encoding layers is capped, the total decompressed...

EUVD-2026-71634

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-84890 undici vulnerable to Denial of Service via unbounded decompression of compressed responses

undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content-encoding layers is capped, the total decompressed output size is unbounded and there is no configuration option to limit it. A malicious or faulty upstream...

CVE-2026-85664

Chroma 1.5.9 , a vector database, fails to enforce maximum bounds on the HNSW index parameters max_neighbors , ef_construction , and ef_search when processing collection-create requests. Because no upper limit is validated, unauthenticated attackers over the network can supply arbitrarily large v...