netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers

A flaw was found in the Netty HAProxy PROXY protocol v2 codec. A remote attacker can exploit this vulnerability by sending a specially crafted HAProxy PROXY protocol v2 header with nested PP2TYPESSL type-length-value TLV records. This can lead to a memory leak, causing the underlying cumulation...

netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification

A flaw was found in Netty, a network application framework. A remote attacker could exploit a vulnerability in the SPDY header decoding process. By sending a specially crafted, small compressed header block, the attacker can cause it to expand significantly during decompression, leading to...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2024-52318

CVE-2024-52318 🚨🚨CVE-2024-52318 - Apache Tomcat XSS Vulnerability in Generated JSPs🚨🚨 Overview CVE-2024-52318 is a crosssite scripting XSS vulnerability in Apache Tomcat, which arises from improperly released resources in generated JavaServer Pages JSPs. This issue, introduced by a prior...

CVE-2026-88290

GeoVision GV-LPC2211 V1.14 260903 allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources...

EUVD-2026-75325

GeoVision GV-LPC2211 V1.14 260903 allows unauthenticated clients to declare unbounded VLSVR frame lengths and indefinitely delay blocking receives, allowing remote exhaustion of memory, connection, and worker resources...

CVE-2026-80352

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges o...

CVE-2026-61909

A flaw was found in cyrus-imapd. An authenticated DAV Distributed Authoring and Versioning user with some shared access to another user's calendar or address book could read unshared events or contacts. This information disclosure occurs by including specific resource identifiers in a...

EUVD-2026-75292

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components. Th...

EUVD-2026-75290

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges o...

CVE-2026-80352 Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache Camel K. A YAML injection vulnerability in custom resource configuration allows an authorized CR author to inject arbitrary Kubernetes objects, potentially enabling unauthorized resource creation with the privileges o...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...

crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

A flaw was found in the crypto/tls package, part of golang. A malicious client can exploit this vulnerability by continuously sending KeyUpdate messages to a server. This forces the server to perform indefinite key derivation operations, leading to resource exhaustion and a Denial of Service DoS...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2026-49362

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

CVE-2025-12748

CVE-2025-12748 Eng Rus Créditos: Svyatoslav Tereshin @TERESH1, Artem Mukhin @saladosss Incidencias: 687, 825 English Descripción Se descubrió un problema en el procedimiento de procesamiento de archivos XML. El procesamiento del contenido del archivo se realiza antes de la comprobación de ACL. Es...

CVE-2025-3500-Poc

Lab: CVE-2025-3500 - Avast Antivirus 整数溢出权限提升漏洞 下载 下载实验 ZIP：https://github.com/chicken3962/CVE-2025-3500-Poc/releases/download/Release/cve-2025-3500.zip 🚀 概述 本仓库提供了一个用于研究 CVE-2025-3500 的实验环境，该漏洞是 Windows 平台上 Avast Antivirus 25.1.981.6...

CVE-2026-38361

CVE-2026-38361：dash-uploader 中多个未经认证的拒绝服务漏洞 fohrloop/dash-uploader（Python，PyPI）中存在多个未经认证的拒绝服务（DoS）问题，包括但不限于：内存溢出（OOM）导致进程崩溃、文件截断为零字节、永久性磁盘耗尽，以及完全绕过文档中声明的 maxfilesize 限制。通过同一组未经清理的参数，还存在其他资源滥用路径。 ⚠️ 无补丁可用，且永远不会发布补丁 该仓库已于 2025-07-19 归档，无活跃维护者。所有已发布版本（0.1.0 至 0.7.0a2）均受影响且将持续受影响。该包每月仍有约 28,000 次下载。...

CVE-2026-31899

CVE-2026-31899：CairoSVG 中通过递归 元素放大导致的指数级拒绝服务 关键词: CVE-2026-31899, CairoSVG, 指数级 DoS, SVG 炸弹, 递归 use 元素, 拒绝服务, XML 放大, Python SVG 漏洞, CWE-400, 不受控制的资源消耗, SVG 亿万笑 目录 概述 漏洞详情 技术分析 概念验证 影响 修复措施 CVSS v3.1 指标 参考 联系方式 概述 CairoSVG 指数级拒绝服务 CVE-2026-31899 — 一个 1,411 字节的 SVG 载荷通过递归 元素放大，使 CPU 无限期保持在 100% 占用...