https://poc.intelseclab.com/tags/cache-poisoning/Latest proof-of-concept entries.Hugoen-usSun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-16_cve-2026-33267-apache-trafficserver-header-spoof/Sun, 16 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-08-16_cve-2026-33267-apache-trafficserver-header-spoof/Critical severity (CVSS 10) — web · CVE-2026-33267 / GHSA-jrh6-9hgv-mqm7. Status: Patched (9.2.15 / 10.1.4). Affects: Apache Traffic Server. Tags: apache, traffic-server, ats, header-injection, metadata-spoof, cache-poisoning, acl-bypass, plugin, CVE-2026-33267.webCriticalapachetraffic-serveratsheader-injectionmetadata-spoofcache-poisoningacl-bypasspluginCVE-2026-33267https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-55315-kestrel-http-request-smuggling/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-06_cve-2025-55315-kestrel-http-request-smuggling/Critical severity (CVSS 9.9) — network · CVE-2025-55315. Status: Weaponized. Affects: ASP.NET Core Kestrel web server (Microsoft.AspNetCore.Server.Kestrel). Tags: aspnet-core, kestrel, http-request-smuggling, chunked-transfer-encoding, dotnet, python, cwe-444, ssrf, cache-poisoning, webshell-upload.networkCriticalaspnet-corekestrelhttp-request-smugglingchunked-transfer-encodingdotnetpythoncwe-444ssrfcache-poisoningwebshell-uploadhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-4893-dnsmasq-ecs-spoofing/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-4893-dnsmasq-ecs-spoofing/Medium severity — network · CVE-2026-4893. Status: PoC. Affects: dnsmasq (DNS forwarder/cache). Tags: dnsmasq, dns, edns, ecs, rfc7871, cache-poisoning, spoofing, udp.networkMediumdnsmasqdnsednsecsrfc7871cache-poisoningspoofingudphttps://poc.intelseclab.com/pocs/network/2026-07-03_nghttpx-http-upgrade-queue-poisoning/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_nghttpx-http-upgrade-queue-poisoning/High severity — network · None assigned as of 2026-07-03. Status: PoC. Affects: nghttp2's nghttpx reverse proxy. Tags: nghttp2, nghttpx, reverse-proxy, request-smuggling, response-queue-poisoning, http-desync, upgrade-request, cache-poisoning.networkHighnghttp2nghttpxreverse-proxyrequest-smugglingresponse-queue-poisoninghttp-desyncupgrade-requestcache-poisoninghttps://poc.intelseclab.com/pocs/web/2026-07-03_nextjs-unstable-cache-key-collision/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-03_nextjs-unstable-cache-key-collision/High severity — web · None assigned as of 2026-07-03. Status: PoC. Affects: Next.js (App Router, Data Cache). Tags: nextjs, unstable_cache, cache-poisoning, cache-key-collision, data-cache, information-disclosure, server-side-caching, javascript.webHighnextjsunstable_cachecache-poisoningcache-key-collisiondata-cacheinformation-disclosureserver-side-cachingjavascripthttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-x-nextjs-data-cache-poisoning/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-x-nextjs-data-cache-poisoning/Low severity (CVSS 3.1) — web · CVE-2026-44572. Status: Researched. Affects: Next.js Pages Router (redirect handling via middleware or next.config.js). Tags: cache-poisoning, x-nextjs-data, redirect, CDN, header-smuggling, Next.js, Pages-Router, unauthenticated.webLowcache-poisoningx-nextjs-dataredirectCDNheader-smugglingNext.jsPages-Routerunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-rsc-response-cache-poisoning/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-rsc-response-cache-poisoning/Medium severity (CVSS 5.4) — web · CVE-2026-44576. Status: Weaponized. Affects: Next.js App Router deployments using React Server Components (RSC) behind shared caches. Tags: cache-poisoning, RSC, response-confusion, Next.js, shared-cache, unauthenticated.webMediumcache-poisoningRSCresponse-confusionNext.jsshared-cacheunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-rsc-cache-busting-weak-hash-collision/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-rsc-cache-busting-weak-hash-collision/Low severity (CVSS 3.7) — web · CVE-2026-44582. Status: Weaponized. Affects: Next.js App Router. Tags: cache-poisoning, RSC, weak-hash, Next.js, unauthenticated.webLowcache-poisoningRSCweak-hashNext.jsunauthenticatedhttps://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-csp-nonce-cache-poisoned-xss/Sun, 17 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-17_nextjs-csp-nonce-cache-poisoned-xss/Medium severity (CVSS 4.7) — web · CVE-2026-44581. Status: Weaponized. Affects: Next.js App Router applications using CSP nonces. Tags: XSS, cache-poisoning, CSP-nonce, Next.js, App-Router, unauthenticated.webMediumXSScache-poisoningCSP-nonceNext.jsApp-Routerunauthenticated