nowafpls

nowafpls 目次 nowafpls WAFの既知の制限 nowafplsのインストール nowafplsの使用方法 著者 ライセンス nowafpls ほとんどのWebアプリケーションファイアウォール（WAF）には、リクエストボディが送信されたときに処理できるデータ量に制限があります。つまり、リクエストボディを含むHTTPリクエスト（POST、PUT、PATCHなど）では、先頭にジャンクデータを付加するだけでWAFをバイパスできることがよくあります。 リクエストにこのジャンクデータが詰め込まれると、WAFはリクエストの先頭からX...

ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

Linux Distros Unpatched Vulnerability : CVE-2026-92284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body...

CVE-2017-14980.RCE

CVE-2017-14980 このエクスプロイトは、Windows 10 x86, build: 16299 上で動作する Sync Breeze Enterprise バージョン 10.0.28 を対象としています。認証されていない攻撃者が HTTP リクエストボディ を介して バッファオーバーフロー を実行し、任意のコード実行 につなげることができます。このエクスプロイトは、すべてのセキュリティ緩和策（例: ASLR、CFG、DEP）が無効になっていることを前提としています。 !NOTE このプロジェクトは、Windows...

CVE-2026-78383 Apache Tomcat: AJP DoS via missing request body

Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1...

Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ip...

CVE-2026-96260 Mattermost server missing request body size limit on plugin routes allows denial of service by an authenticated user

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2026-96260

The Mattermost server is vulnerable to a denial of service because it fails to enforce a request body size limit during CSRF validation of plugin requests. This flaw allows an authenticated user to exhaust server memory by sending a large request body to a plugin endpoint. Affected versions inclu...

CVE-2026-96260: Memory Allocation with Excessive Size Value

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 fail to enforce a request body size limit during CSRF validation of plugin requests which allows an authenticated user to exhaust server memory and cause a denial of service via a large request body sent to ...

CVE-2025-1974

README 口で言うのは簡単だ。コードを見てみろ。 詳細は https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities で確認できます。 使い方 1. shell.c 内の IP を変更する。 2. Docker が利用可能か確認し、make shell.so を実行する。nginx-ingress-controller は musl-libc ベースのため、確実に動作させるには Alpine で .so をビルドする必要があります 3. python3 exploit.py を実行してシェルを取得する。 25 行目...

CVE-2026-34040-PoC

CVE-2026-34040 — Docker/Moby AuthZ プラグイン バイパス（ラボ PoC） KO: Docker（Moby）の認可（AuthZ）プラグインを 1MB を超えるリクエストボディ でバイパスする脆弱性の実習用再現プロジェクトです。 EN: Docker（Moby）の認可（AuthZ）プラグインを 1MB を超えるリクエストボディ でバイパスする脆弱性のラボ再現です。 脆弱性の事実 / 脆弱性の詳細 項目| 値 ---|--- CVE| CVE-2026-34040 CVSS 3.1| 8.8（High）—...

CVE-2026-63405: Insufficient Verification of Data Authenticity

AnyCable is a realtime server for reliable two-way communication that supports any backend. Prior to 1.6.15, the Pusher-compatible REST API in pusher/http.go includes the caller-supplied bodymd5 value in the HMAC input but does not calculate the digest of the received request body or compare it...

tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation

In Apache Tomcat, no limit was enforced on the request body for WebDAV LOCK or PROPFIND requests which were available to unauthenticated users. This allows a remote attacker to consume excessive resources, leading to Denial of Service DoS, making the affected system unavailable to legitimate user...

CVE-2026-53659

A flaw was found in http4k, a functional toolkit for Kotlin HTTP applications. The ServerFilters.GZip and RequestFilters.GunZip functions, along with underlying Gzip request-body decompression, do not limit the decompressed size of incoming data. An unauthenticated client can exploit this by...

CVE-2026-91819

Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs...

CVE-2026-91080

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash...

CVE-2026-91080

webhook through 2.8.3 (a Go-based webhook receiver) is vulnerable to unauthenticated memory exhaustion . The service reads the entire request body into memory before evaluating trigger rules, with no enforced size limit. An attacker can send a multi-gigabyte request body with an invalid signature...

CVE-2026-91080 webhook through 2.8.3 Memory Exhaustion via Oversized Request Body

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash...

CVE-2026-91080 webhook through 2.8.3 Memory Exhaustion via Oversized Request Body

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash...

CVE-2026-91080 webhook through 2.8.3 Memory Exhaustion via Oversized Request Body

webhook through 2.8.3 reads the entire request body into memory before evaluating trigger rules, allowing unauthenticated attackers to exhaust memory by sending oversized bodies. Attackers can send multi-gigabyte request bodies with invalid signatures to trigger out-of-memory conditions and crash...