macsurf

The modern web, on a 25-year-old Mac. A native browser for the Carbon era, Mac OS 8.6 through Mac OS X 10.6: real CSS, modern JavaScript, and HTTPS on the Mac itself. No proxy, no second machine. MacSurf 2.0.5 on a Power Mac G3 iMac, renderinghackaday.com at full desktop width over native HTTPS...

tls

ztls A TLS 1.3 implementation for QUIC written in Zig, strictly adhering to RFC 8446 TLS 1.3 and RFC 9001 QUIC-TLS. Status Aspect| Info ---|--- API Stability| Production Zig Version| 0.16.0 Platforms| Linux, macOS, Windows Performance note The 2 ms handshake target is validated on Ed25519 and...

ssh3

!NOTE SSH3 is probably going to change its name. It is still the SSH Connection Protocol RFC4254 running on top of HTTP/3 Extended connect, but the required changes are heavy and too distant from the philosophy of popular SSH implementations to be considered for integration. The specification dra...

challenge_CVE-2020-13777

Chanllenge CVE-2020-13777 Try to prove if TLS 1.3 MITM is possible and decrypt 0-RTT early data in pcap here Server: 192.168.100.23:5556. See https://jovi0608.hatenablog.com/entry/2020/06/13/104905 and CVE-2020-13777 for details...

cve-2022-25640-exploit

Exploiting CVE-2022-25640 using scapy See CVE-2022-25640.ipynb. CVE-2022-25640 is a vulnerability in wolfSSL before 5.2. It allows a client to circumvent mututation authentication in TLS 1.3 connections...

CVE-2020-1967

CVE-2020-1967 Proof of concept exploit about OpenSSL signaturealgorithmscert DoS flaw CVE-2020-1967. Credit for the original finding to Bernd Edlinger, additional analysis by Matt Caswell and Benjamin Kaduk, this demo by Imre Rad. Prerequisite Server or client applications that call the...

CVE-2025-23048-POC

CVE-2025-23048: Apache modssl TLS 1.3 Session Resumption Client Certificate Bypass Apache HTTP Server versions 2.4.35 – 2.4.62 are vulnerable to a client certificate authentication bypass when TLS 1.3 session resumption is used across virtual hosts with different SSLCACertificateFile directives. ...

camel-pqc-tls

Post-Quantum TLS with Apache Camel This repository contains three examples demonstrating Post-Quantum Cryptography PQC TLS 1.3 handshakes with Apache Camel, using the X25519MLKEM768 hybrid key exchange. X25519MLKEM768 combines classical X25519 elliptic curve Diffie-Hellman with ML-KEM-768 , a...

PoC_TLS1_3_CVE-2020-13777

PoC TLS1.3 CVE-2020-13777 The purpose of this PoC This PoC and related article were created to apply for the project "Challenge CVE-2020-13777". CVE-2020-13777 is a GnuTLS vulnerability whose patch is widely distributed. This PoC aims to contribute to improving the information security literacy o...

DEBIAN-CVE-2026-116541

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541

The netty-tcnative library before version 2.0.84.Final is vulnerable to a Denial of Service (DoS) flaw within the tcn_write_to_bytebuffer BIO write callback. The root cause is an incorrect calculation where the callback overreports the number of bytes consumed. This allow remote TLS 1.3 peers to ...

CVE-2026-116541 netty-tcnative before 2.0.84.Final Denial of Service via BIO Write Overcount

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-116541

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

EUVD-2026-109911

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcnwritetobytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail...

CVE-2026-93446

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3...

UBUNTU-CVE-2026-93446

Incomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...