PoC_CVE-2025-11579

PoC CVE-2025-11579 概述 rardecode 版本 = 2.1.1 在读取较大的 RAR 字典大小时未能限制字典大小，这允许攻击者提供特制的 RAR 文件，并通过内存不足崩溃导致拒绝服务。 漏洞利用 我们构造一个具有人为超大字典大小的 RAR 文件，导致库尝试进行大规模内存分配，然后发生内存不足崩溃。 漏洞利用步骤 1. 使用 14Gb.rar 文件并执行 go run exploit.go。 2. 使用提供的普通 simple.rar 文件并运行漏洞利用程序。它被成功提取。...

CVE-2026-57173

A flaw was found in vLLM, an inference and serving engine for large language models. An unauthenticated client can exploit this by submitting a small, compressed audio input that expands into a very large memory allocation. This bypasses existing duration guards, leading to an out-of-memory...

EUVD-2026-80880

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...

CVE-2026-57173 vLLM: Unauthenticated audio decompression-bomb DoS in /v1/chat/completions

vLLM is an inference and serving engine for large language models. Prior to 0.24.0, the inputaudio handling path for /v1/chat/completions calls AudioMediaIO.loadbytes or AudioMediaIO.loadfile without passing VLLMMAXAUDIODECODEDURATIONS to the shared audio decoder. An unauthenticated client can...

VLC-CVE-2008-4654-Exploit

VLC-CVE-2008-4654-利用 嗯，这只是一个旧漏洞，其CVE编号是CVE-2008-4654。该漏洞由 modules/demux/ty.c 第1650行的内存不足导致。 root@kitploit: streamReadpdemux-s, mstbuf, 8 + imapsize; 当我从其他网站下载EXP时，发现它在我的Windows 7 Ultimate x64上无法正确运行。所以我将返回地址从0x68f0cfad改为0x6a314b52，然后就成功了！ 旧版： root@kitploit: 0x68f0cfad : jmp esp PAGEEXECUTEREAD...

BUGS_OOM_NULL_PTR_DEREF

BUGSOOMNULLPTRDEREF Android 上的空指针解引用（NULL PTR DEREF）漏洞，OOM 只是为了好玩...

CVE-2019-12401

CVE-2019-12401: Apache Solr 中的 XML 炸弹 5.0.0 之前的 Solr 版本容易受到通过其更新处理器的 XML 资源消耗攻击（即 Lol 炸弹）的影响。 通过利用 XML DOCTYPE 和 ENTITY 类型元素，攻击者可以创建一个模式，当服务器解析 XML 时该模式会扩展，导致内存溢出 OOM。 供应商披露： 供应商对该漏洞的披露和修复可以在此处找到。 概念验证： 更多细节和利用过程可以在这个PDF中找到。...

CVE-2026-53716

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled...

CVE-2026-53717

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm.code.image.url values to Docker or OCI Wasm layers, and...

CVE-2026-54247

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.26.22, Handler in dataclients/kubernetes/admission/admission.go passes the body of requests to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAllr.Body without a size limit. An attacker with...

CVE-2026-53716

Envoy Gateway (open-source application gateway managing Envoy Proxy) has an unbounded gzip decompression vulnerability in getFileFromGZ within internal/wasm/httpfetcher.go. The function calls io.ReadAll on a gzip.Reader without limiting the decompressed output size. When a tenant-controlled Envoy...

CVE-2026-53716 Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip.Reader without limiting decompressed output when a tenant-controlled...

CVE-2026-53717 Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm.code.image.url values to Docker or OCI Wasm layers, and...

CVE-2026-53717

Envoy Gateway (open-source Envoy Proxy management) is vulnerable in internal/wasm/imagefetcher.go prior to 1.7.4 and 1.8.1 . The function extractWasmPluginBinary allocates memory using the untrusted tar-header h.Size value (via make([]byte, h.Size)) before validating the entry name or declared si...

CVE-2026-53717 Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, internal/wasm/imagefetcher.go follows tenant-controlled EnvoyExtensionPolicy spec.wasm.code.image.url values to Docker or OCI Wasm layers, and...

CVE-2026-91080

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash...

CVE-2026-91080

webhook through 2.8.3 (a Go-based webhook receiver) is vulnerable to unauthenticated memory exhaustion . The service reads the entire request body into memory before evaluating trigger rules, with no enforced size limit. An attacker can send a multi-gigabyte request body with an invalid signature...

EUVD-2026-77715

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash...

Astra Linux – Vulnerability in Bouncycastle

Bouncy Castle for Java before version 1.73 contains a potential Denial of Service DoS issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM-encoded streams containing X.509 certificates, PKCS8-encoded keys, and PKCS7 objects. Parsing a file that...

netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak

A flaw was found in netty-codec-http2. A remote attacker could send specially crafted frames that cause a resource leak within the DelegatingDecompressorFrameListener class. This resource leak could lead to an Out Of Memory Error OOME, potentially causing a Denial of Service DoS by taking down th...