CVE-2021-42697

Akka HTTP 10.1.x（10.1.15未満）および10.2.x（10.2.7未満）では、HTTPヘッダーの解析中にスタック枯渇が発生する可能性があり、これによりリモートの攻撃者が深くネストされたコメントを含むUser-Agentヘッダーを送信してサービス拒否攻撃を行うことができます。 参考文献 MITRE Akka ブログ コメントの任意のネスト 基本的なAkkaセットアップガイド PoC ノート テスト対象バージョン: 10.2.4 ターゲットサーバーのフィンガープリント: akka-http/ ペイロードスニペット: User-Agent:...

katana

Katana 2016年から2019年の間にリリースされたQualcommデバイス向けのBootROMエクスプロイトです。 エクスプロイトの概要 MSM8998 Nazgul SoCでは、コマンド0x13 SAHARARESETSTATEMACHINEID が追加されました。このコマンドは bootsaharaentry を呼び出します。これはSaharaを再初期化することを目的としています。問題は、呼び出しのたびに スタックポインタが0x60だけ減少し、スタックガードが存在しないことです。十分な回数呼び出すと、利用可能な スタック領域 0x3000...

CVE-2025-46206

MuPDF 1.25.6 およびそれ以前のバージョンには、サービス拒否の脆弱性が存在します。攻撃者が "mutool clean poc /dev/null" コマンドを実行すると、プログラムは pdf-clean-file.c 内の stripoutlines 関数と stripoutline 関数の間で無限再帰に陥り、スタックが枯渇するまで続きます。 具体的な POC ファイル、脆弱性の原因、再現手順、および修正提案については、添付ファイルを参照してください。 ベンダー（MuPDF のメンテナである Artifex...

openSUSE 16 Security Update : rustup (openSUSE-SU-2026:22016-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22016-1 advisory. - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded bsc1243862. - CVE-2025-58160:...

Damn_Vulnerable_C_Program

注：ファイル名はimgRead.cからdvcp.cに変更されました。動画をご覧の場合はimgRead.cと表示されますが、GitHubリポジトリではdvcp.cとなっていますので、正しいファイル名を使用してください。 Damn Vulnerable C ProgramDVCP 私のYouTubeチャンネル: https://www.youtube.com/user/MrHardik05/featured?viewas=subscriber これは何ですか？ これは、一般的な種類の脆弱性を説明するために私がコーディングしたシンプルなCプログラムです。例: 1. 整数オーバーフロー 2...

Linux Distros Unpatched Vulnerability : CVE-2026-66858

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough ca...

CVE-2026-83663

A flaw was found in Apache Thrift. A remote attacker can cause a Denial of Service DoS by sending specially crafted network frames with zero payload bytes to an affected Go service. When processing these empty frames, the transport recursively calls its read function rather than iterating in a...

CVE-2026-66858

A flaw was found in Apache Thrift. Multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can exploit this vulnerability by sending a message containing deeply nested unknown fields, leading to stack...

AZL-105950 CVE-2026-66858 affecting package thrift 0.24.0-1

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

DEBIAN-CVE-2026-66858

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-66858

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

EUVD-2026-91585

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-66858 Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift: skip() does not apply the recursion limit (Python accelerator, PHP, Perl, Lua, Smalltalk, OCaml)

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its...

CVE-2026-66858

Apache Thrift versions before 0.25.0 are vulnerable to a Denial of Service (DoS) attack due to a flaw in the protocol skip routine. Specifically, multiple language bindings fail to enforce recursion limits when processing skipped fields in incoming messages. A remote, unauthenticated attacker can...

CVE-2026-94650 Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)

Uncontrolled Recursion vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-94650 Apache Thrift: c_glib generated struct readers have no recursion-depth guard (native stack exhaustion)

Uncontrolled Recursion vulnerability in Apache Thrift cglib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CLEANSTART-2026-XZ73370 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details...

CLEANSTART-2026-YF33963 Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

CVE-2026-56859 affects multiple packages. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. See references for individual vulnerability details...

PT-2026-104324

The protocol skip routine in several Apache Thrift bindings did not apply the binding's recursion limit, so a message that nests unknown fields deeply enough can exhaust the stack. Affected: the Python C++ accelerator the pure-Python protocols are not affected, the PHP library and its thrift...