51 matches found
cve-2025-24035-rds-websocket-dos-test
CVE-2025-24035 Test di stress WebSocket Sicuro 🚨 AVVERTENZA : Questo NON è un exploit. Questo script è una simulazione e deve essere utilizzato esclusivamente per scopi educativi in un ambiente di laboratorio sicuro. Scopo Questo test invia un header WebSocket deliberatamente sovradimensionato pe...
CVE-2026-34040-PoC
CVE-2026-34040 — Docker/Moby AuthZ-Plugin-Bypass Lab-PoC KO: Ein Projekt zur Reproduktion einer Schwachstelle für Übungszwecke, die die Autorisierungs-AuthZ-Plugins von DockerMoby mithilfe eines über 1 MB großen Anforderungsrumpfs umgeht. EN: Eine Laborreproduktion einer Schwachstelle, die Docker...
Linux Distros Unpatched Vulnerability : CVE-2026-73198
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large...
CVE-2026-73228
A flaw was found in Django REST framework. A remote attacker could exploit a vulnerability in the request.data parsing mechanism, which bypasses Django's DATAUPLOADMAXMEMORYSIZE protection. This allows an attacker to send oversized JSON and URL-encoded request bodies, leading to excessive...
CVE-2026-73228
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...
CVE-2026-73228
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in restframework/request.py Request.parse passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies...
SUSE CVE-2026-55434
Coder allows organizations to provision remote development environments via Terraform. Starting in version 2.33.0 and prior to versions 2.33.8 and 2.34.2, AI Bridge provider handlers read request bodies with io.ReadAll without a maximum size so an authenticated user with AI Bridge access could se...
CVE-2026-51266
CVE-2026-51266 is rejected/not used and does not represent an active vulnerability entry.
CVE-2026-65604
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...
CVE-2026-65604
Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent OPA deny-on-presence Rego policies. When a request body exceeds the configured maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates against...
CVE-2026-51606
An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 firmware V31.1.9.91 causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response...
GHSA-X4GW-5CX5-PGMH Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes
SslClientHelloHandler.decode reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates ctx.alloc.bufferhandshakeLength line 161. The guard at line 140 is handshakeLength maxClientHelloLength && maxClientHelloLength != 0, and the...
Exploit for Authentication Bypass Using an Alternate Path or Channel in Mobyproject Moby
CVE-2026-34040 Full Lab PoC Docker/Moby AuthZ Plugin Bypass...
CVE-2026-2325
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to...
📄 ZTE ZXHN Router Denial of Service
The CGILua post.lua parser used in ZTE ZXHN routers does not enforce an upper bound on the body size of application/x-www-form-urlencoded POST requests. An unauthenticated attacker can crash or freeze the router's web management service by sending a single HTTP POST request with an oversized body...
CVE-2026-2325
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to...
CVE-2026-2325 Improper Input Validation in MS Teams Meetings API Handler
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to...
CVE-2026-2325 Improper Input Validation in MS Teams Meetings API Handler
Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13, 11.4.x = 11.4.3 fail to limit the size of the request body on the start meeting API endpoint, which allows an authenticated attacker to cause resource exhaustion or denial of service via a crafted oversized HTTP POST request to...
