cve-2021-44790-lab

CVE-2021-44790 Lab This repository contains a small local lab and proof-of-concept tooling for reproducing the Apache HTTP Server vulnerability tracked as CVE-2021-44790. Overview CVE-2021-44790 is a vulnerability in Apache HTTP Server 2.4.51/2.4.52 involving the modlua multipart request parser. ...

CVE-2026-110658

A flaw was found in Sofia-SIP. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a specially crafted Session Initiation Protocol SIP message containing an oversized multipart boundary that exceeds the message body length. During message parsing, this flaw causes the...

@fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...

GHSA-XJH9-V7X6-24JW @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The vendored streaming multipart search stores its default skip distance in a Uint8Array256. A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wra...

Exploit for Out-of-bounds Write in Apache Http_Server

CVE-2021-44790 Lab This repository contains a small local lab...

CVE-2026-54571

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores boundaryPosition as an 8-bit value while parseMultipartPostByte processes the boundary. A remote request...

CVE-2026-54571 ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores boundaryPosition as an 8-bit value while parseMultipartPostByte processes the boundary. A remote request...

CVE-2026-54571

ESPAsyncWebServer (an asynchronous HTTP/WebSocket server library for ESP32, ESP8266, RP2040, and RP2350) contains an integer overflow in its multipart/form-data parser (src/WebRequest.cpp). Prior to version 3.11.1, the _boundaryPosition variable is stored as an 8-bit value ; a remote request with...

CVE-2026-54571 ESPAsyncWebServer: Integer overflow in multipart boundary parser causes denial of service

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores boundaryPosition as an 8-bit value while parseMultipartPostByte processes the boundary. A remote request...

Astra Linux – Vulnerability in libmicrohttpd

GNU libmicrohttpd before version 0.9.76 allowed remote Denial of Service attacks due to improper parsing of a multipart/form-data boundary in the postprocessor.c MHDcreatepostprocessor method. This allowed attackers to remotely send a malicious HTTP POST packet that included one or more '\0' byte...

CVE-2026-76651

A buffer overflow in the embedded HTTP service of the TP-Link TL-WR841N v14 is triggered when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter allows a remote, unauthenticated attacker from the adjacent network to corrupt memory beyond ...

CVE-2026-76651 Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N

A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter may allow a remote unauthenticated attacker to submit a crafted request that corrupts memory by...

CVE-2026-76651 Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N

A buffer overflow vulnerability exists in the embedded HTTP service in TL-WR841N v14 when processing multipart/form-data requests. Insufficient validation of an attacker-controlled boundary parameter may allow a remote unauthenticated attacker to submit a crafted request that corrupts memory by...

SUSE CVE-2026-19484

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...

CVE-2026-19484 @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...

CVE-2026-19484 @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...

CVE-2026-19484

@fastify/busboy versions 3.1.0–3.2.0 are vulnerable to a Denial of Service via crafted multipart boundaries. The root cause is a fixed 256-entry skip table in the vendored streaming search; a boundary of exactly 252 bytes makes the search needle 256 bytes, truncating the skip distance to zero and...

CVE-2026-19484 @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary

@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256...

CVE-2026-45705

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...

CVE-2026-45705 OpenSIPS: OOB Read in Multipart Body Boundary Parsing

OpenSIPS is a Session Initiation Protocol SIP server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the findlinedelimiter function in the multipart body parser performs an out-of-bounds read via strncmp when searching for MIME boundary delimiters. After finding a -- pattern near the en...