PoC_CVE-2025-11579

PoC CVE-2025-11579 概要 rardecode バージョン = 2.1.1 は、大きな RAR 辞書サイズを読み取る際に辞書サイズの制限に失敗します。これにより、攻撃者が特別に細工した RAR ファイルを提供し、メモリ不足によるクラッシュを介したサービス拒否 Denial of Service を引き起こすことが可能です。 エクスプロイト 人為的に大きな辞書サイズを持つ RAR ファイルを作成し、ライブラリに大量のメモリ割り当てを試行させ、その後メモリ不足によるクラッシュを発生させます。 エクスプロイト手順 1. 14Gb.rar ファイルを使用し、go run...

BUGS_OOM_NULL_PTR_DEREF

BUGSOOMNULLPTRDEREF 안드로이드 NULL PTR DEREF, OOM 버그, 그냥 재미로...

VLC-CVE-2008-4654-Exploit

VLC-CVE-2008-4654-利用 嗯，这只是一个旧漏洞，其CVE编号是CVE-2008-4654。该漏洞由 modules/demux/ty.c 第1650行的内存不足导致。 root@kitploit: streamReadpdemux-s, mstbuf, 8 + imapsize; 当我从其他网站下载EXP时，发现它在我的Windows 7 Ultimate x64上无法正确运行。所以我将返回地址从0x68f0cfad改为0x6a314b52，然后就成功了！ 旧版： root@kitploit: 0x68f0cfad : jmp esp PAGEEXECUTEREAD...

http4s has HTTP/2 Denial of Service with Ember Backend

Summary http4s 0.23.x and 1.0 servers running ember with http2 enabled are vulnerable to a denial of service attack using a HPACK bomb vulnerability recently disclosed as affecting other http2 servers. Impact Denial of Service: - Affects any http4s server running the ember backend with HTTP/2...

CVE-2026-54556

http4s (Scala HTTP library) versions prior to 0.23.35 and 1.0.0-M47 are vulnerable to an out-of-memory denial of service when using the Ember backend with HTTP/2 enabled. The root cause is a HPACK bomb : the Hpack wrapper concatenates HEADERS and CONTINUATION frame fragments into a single decoded...

CVE-2019-12401

CVE-2019-12401: XML-Bombe in Apache Solr Solr-Versionen vor 5.0.0 sind über ihren Update-Handler anfällig für einen XML-Ressourcenverbrauchs-Angriff auch bekannt als Lol Bomb. Durch die Nutzung von XML-DOCTYPE- und ENTITY-Typ-Elementen kann der Angreifer ein Muster erstellen, das sich beim Parsen...

CVE-2026-12600

Denial-of-service DoS vulnerability in the internal JPEG2000 JPX decoding implementation of the Poppler fork developed by Innodata Labs. When an application processes an untrusted PDF file containing specially crafted JPXDecode images, a remote attacker can cause uncontrolled memory consumption...

CVE-2026-14682

A flaw was found in Bouncy Castle for Java, including its LTS and FIPS variants. This vulnerability allows a remote attacker to trigger an Out-Of-Memory OOM error by providing specially crafted input during a definite-length read operation. This unbounded memory allocation can lead to a Denial of...

Astra Linux – Vulnerability in Bouncycastle

Bouncy Castle for Java before version 1.73 contains a potential Denial of Service DoS issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM-encoded streams containing X.509 certificates, PKCS8-encoded keys, and PKCS7 objects. Parsing a file that...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

CVE-2026-53585

libgit2 versions before 1.8.6 and 1.9.5 are vulnerable: git_delta_apply in src/libgit2/delta.c passes an attacker-controlled res_sz value to git__malloc before validating delta instructions, allowing a small multi-level OFS_DELTA chain to retain huge allocations and exhaust memory. Attack vectors...

GHSA-QQFF-5854-PX68 vouch-proxy has an Unbounded Multipart Cookie Allocation DoS

Unbounded Multipart Cookie Allocation DoS in vouch-proxy Summary vouch-proxy v0.47.2 contains an unauthenticated remote denial-of-service vulnerability in its multipart cookie reassembly logic. The /validate endpoint parses the total cookie part count directly from the attacker-controlled cookie...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...

PT-2026-80760

Name of the Vulnerable Software and Affected Versions vouch-proxy version 0.47.2 Description An unauthenticated remote denial-of-service issue exists in the multipart cookie reassembly logic. The /validate and / external-auth-:id endpoints parse the total cookie part count directly from the cooki...

PT-2026-78680

Name of the Vulnerable Software and Affected Versions BuildKit versions prior to 0.31.1 Description BuildKit reads /etc/passwd and /etc/group files without an upper bound when resolving a username to a user or group identifier within the executor/oci/user.go and solver/llbsolver/ops/user linux.go...

UBUNTU-CVE-2026-63336

The RabbitMQ Java client library allows Java and JVM-based application...

GO-2026-6115 WITHDRAWN: Multiple denial of service vulnerabilities in rsc.io/pdf and forks

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". The PDF parser in rsc.io/pdf and its downstream forks github.com/ledongthuc/pdf and github.com/dslipak/pdf contains multiple defects when parsing untrusted input: - Unchecked /Size, /Index,...

GO-2026-6173 WITHDRAWN: Pre-protocol error reader permits unbounded memory consumption in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". The special-case parser for PostgreSQL pre-protocol plain-text errors in github.com/lib/pq calls bufio.Reader.ReadString0 without a byte limit. A malicious PostgreSQL endpoint or active...

RabbitMQ Java client ValueReader: Oversized LongString/bytes length triggers OOM via unchecked allocation

Summary ValueReader.readBytes allocates a byte array sized by a wire-declared content length without validating it against actual frame data. A malicious AMQP peer triggers OOM by declaring a 2GB string/bytes field. Vulnerable Code src/main/java/com/rabbitmq/client/impl/ValueReader.java lines...

brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function

A flaw was found in brace-expansion. A remote attacker can exploit this vulnerability by providing specially crafted input to the expand function, which can lead to excessive memory consumption. This can cause a denial of service DoS by crashing the application due to an out-of-memory error...