valhalla

valhalla Valhalla는 shodan에서 취약한 장치를 찾아내며, 도메인 목록을 스캔하여 취약점을 탐지할 수도 있습니다. 설치 git clone https://github.com/gotr00t0day/valhalla.git cd valhalla pip3 install -r requirements.txt chmod +x install.sh ./install.sh 사용법 root@kitploit: , , |\ , |\ / . \ -.:. \ -. =====| /='/ ^\ .' /\ .= .-' .'| '-/| .' ...

CVE-2026-54716

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

EUVD-2026-82404

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-54716 Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-54716

Valhalla (open source routing engine for OpenStreetMap data) versions 3.7.0 and earlier are vulnerable to a denial-of-service via the /sources_to_targets endpoint. A single unauthenticated POST request containing an exclude_polygons ring formed by three collinear points (zero-area geometry) trigg...

CVE-2026-54716 Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-54716 Valhalla: Degenerate exclude_polygons (collinear points, zero area) causes OOM in /sources_to_targets

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-54716: Allocation of Resources Without Limits or Throttling

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. In 3.7.0 and earlier, a POST request to /sourcestotargets containing an excludepolygons ring formed by three collinear points can cause unbounded memory growth in the worker. The zero-area...

CVE-2026-49294

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting XSS due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, t...

CVE-2026-49294 Valhalla has reflected XSS via unsanitized JSONP callback parameter

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting XSS due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, t...

EUVD-2026-36741

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting XSS due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, t...

CVE-2026-49294

Valhalla (open source routing engine) versions ≤ 3.6.3 are affected by a reflected XSS in the JSONP callback parameter. The input is reflected into the JavaScript response without validation or encoding, enabling an attacker to craft a URL whose callback contains arbitrary JavaScript. If a victim...

CVE-2026-49294 Valhalla has reflected XSS via unsanitized JSONP callback parameter

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting XSS due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, t...

CVE-2026-49294: Improper Neutralization of Input During Web Page Generation

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting XSS due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, t...

PT-2026-49261

Name of the Vulnerable Software and Affected Versions Valhalla versions prior to 3.6.4 Description Reflected cross-site scripting XSS occurs due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, the value is reflected directly into the...

This Week in Spring - September 9th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! I am home, ensconced in my studio here in somewhat sunny San Francisco, California, relaxing and trying to catch up on stuff I missed. As always, there's a ton! So let's dive right into it. Some of the amazing features that...

This Week in Spring - September 3rd, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's September 3rd, and I'm still buzzing from the last week's SpringOne extravaganza! Also: I'm tired. Last week was nuts. I'm super glad it happened, but I'm tired. And also buzzing. You know? Surely you don't. I hope not...

Fedora 40 : clamav (2024-34474f346b)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-34474f346b advisory. ClamAV 1.0.6 is a critical patch release with the following fixes: Updated select Rust dependencies to the latest versions. This resolved Cargo audit...

Fedora 38 : clamav (2024-92b8ac25a5)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-92b8ac25a5 advisory. ClamAV 1.0.6 is a critical patch release with the following fixes: Updated select Rust dependencies to the latest versions. This resolved Cargo audit...

Fedora 39 : clamav (2024-1a79c2ef63)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-1a79c2ef63 advisory. ClamAV 1.0.6 is a critical patch release with the following fixes: Updated select Rust dependencies to the latest versions. This resolved Cargo audit...