CVE-2025-55182

CVE-2025-55182 Toolkit & Lab Educational Only Lightweight Go toolkit plus a Dockerized Next.js lab to explore and triage CVE-2025-55182. For educational and authorized testing only. Features Root-cause writeup, visuals, and lab: see React2ShellDeconstructingaPerfect10RCE.pdf and the attack-path...

CVE-2026-128127

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.readchunk processing a multipart part with Content-Transfer-Encoding set to base64 keeps reading until the chunk length is a multiple of four without enforcing a byte limit. A short...

CVE-2026-108147

A flaw was found in Django. A remote attacker could cause a Denial of Service DoS by submitting a specially crafted multipart request with base64-encoded file data. When handling these uploads, the parser buffers the data entirely into system memory regardless of configured upload memory limits,...

PT-2026-147166

Name of the Vulnerable Software and Affected Versions AIOHTTP versions prior to 3.14.4 Description An issue exists in the read chunk function when processing a multipart part with the Content-Transfer-Encoding set to base64. The system continues reading until the chunk length is a multiple of fou...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

php2shell-scanner A command-line tool for detecting CVE-2026-...

CLEANSTART-2026-GW20609 Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks

Security vulnerability affects the apache-nifi package. Spring MVC and WebFlux applications are vulnerable to Multipart request smuggling attacks...

CVE-2026-116134

A flaw was found in perl-http-body. The multipart request parser does not restrict the size or number of lines within a part's header block before storing them in memory. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with an excessively large multipa...

OESA-2026-4559 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with a...

OESA-2026-4560 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with a...

OESA-2026-4558 python-aiohttp security update

Async http client/server framework asyncio. Security Fixes: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with a...

PHP 8.5.11 PHP2Shell Scanner

PHP versions before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 contain memory-handling flaws that can allow unauthenticated remote code execution. This tool sends multipart request probes and identifies susceptible targets from crash signals or the X-Powered-By version...

PHP2SHELL

!php2shell — behavioural detection and exploit chainassets/ba...

Exploit for Improperly Controlled Sequential Memory Allocation in Php

CVE-2026-109618-POC Multipart OOM bailout corruption trigger...

PHP 5.6.40 Security Patch

PHP version 5.6.40 contains vulnerabilities in multipart request parsing and stale request state handling; this patch backports fixes for both issues...

PHP 7.4.33 State Corruption Security Backport

PHP version 7.4.33 backports upstream fixes for state corruption and multipart request handling vulnerabilities. It provides patched Docker image and Debian package build definitions for EOL PHP 7.4 deployments...

Exploit for CVE-2026-109618

PHP CVE-2026-109618 / CVE-2026-109619 — DoS Attack Toolkit...

Exploit for CVE-2026-109618

PHP multipart request-shape WAF/IDS signals Scope correctio...

CVE-2026-111066

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart...

CVE-2026-111066

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart...

CVE-2026-111066

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded number of open file descriptors. An unauthenticated attacker can consequently exhaust file descriptors with specially crafted multipart...