tag
Denial-of-Service
Crawl4AI Docker API Server Arbitrary File Write via `output_path` (CVE-2026-56260)
Crawl4AI's Docker API server exposes /screenshot and /pdf endpoints that accept an outputpath parameter specifying where the rendered output should be saved. The parameter is passed straight into a file-write call with no validation whatsoever — no check for…
ZTE Router Unauthenticated Oversized-POST Denial of Service (CVE-2026-34473)
CVE-2026-34473 is an unauthenticated denial-of-service condition in ZTE H-series routers' web management interface, rooted in how the cgilua/post.lua pre-auth request-body parser handles oversized application/x-www-form-urlencoded POST bodies. Sending a…
Windows CLFS.sys Unrecoverable State / BSoD via ReadFile on Log File Handle (CVE-2026-2636)
CVE-2026-2636 is a denial-of-service vulnerability in the Windows Common Log File System driver (CLFS.sys). An unprivileged local user can crash the system simply by calling the ReadFile Win32 API on a handle obtained via CreateLogFile — a call sequence CLFS…
TanStack Query — Unbounded Recursion Denial of Service in `replaceEqualDeep` (CVE-2026-26903)
TanStack Query's internal replaceEqualDeep function recursively performs deep-equality comparisons between old and new query cache data so that unchanged object references can be preserved across re-renders. The recursive implementation has no depth limit or…
Sliver C2 Server mTLS Nil-Pointer Panic / Infrastructure Kill-Switch — CVE-2026-29781
Sliver C2's transport-layer protobuf handlers (mTLS, WireGuard, DNS) lack consistent nil-pointer validation and lack a recover() mechanism around packet processing. A party in possession of a captured implant's mTLS certificate, private key, and Age secret…
rldns 1.3 Heap-Based Out-of-Bounds Read Remote DoS (CVE-2026-27831)
rldns is an open-source DNS server for Linux, FreeBSD, and NetBSD. Version 1.3 contains a heap-based out-of-bounds read that can be triggered remotely by sending a specially crafted, malformed DNS-like UDP packet, causing the server process to crash and…
pypdf Circular Outline Reference Infinite-Loop DoS (CVE-2026-24688)
pypdf's outline (bookmark) parser walks the linked list of outline entries via the /Next pointer without any cycle detection or iteration cap. A PDF crafted with a circular outline reference (an entry whose /Next chain loops back on itself) causes…
PX4-Autopilot tattu_can Driver — CAN Bus Stack Buffer Overflow DoS (CVE-2026-32707)
The tattucan driver in PX4-Autopilot reassembles multi-frame Tattu12SBatteryMessage telemetry from the battery's CAN bus into a fixed 48-byte stack buffer, but performs the per-frame memcpy() without checking the cumulative write offset against the buffer…
PX4 Autopilot MAVLink FTP Stack Buffer Overflow (CVE-2026-32743)
PX4 Autopilot's MAVLink FTP log-handling code (MavlinkLogHandler / MAVLink FTP directory listing path) copies an attacker-supplied directory path into a fixed-size stack buffer without validating its length. Sending a MAVLink FTP request (e.g. via…
PJSIP DNS Compression Pointer Heap Out-of-Bounds Read (CVE-2026-32945)
getnamelen() and getname() in pjproject's pjlib-util/src/pjlib-util/dns.c read a 2-byte DNS message-compression pointer via pjmemcpy(&offset, p, 2) without verifying that both bytes fall within the received packet buffer. If the compression-pointer marker…
Oracle VirtualBox Shared Folders Kernel Memory Exhaustion DoS (CVE-2026-21986)
CVE-2026-21986 is a denial-of-service vulnerability in the VirtualBox Shared Folders driver interface exposed to Windows guests as the device \\.\VBoxMiniRdrDN. The driver's IOCTLMRXVBOXADDCONN handler accepts user-controlled connection-string buffers and…
OpenSTAManager Global Search Amplified Time-Based Blind SQL Injection — CVE-2026-24417
OpenSTAManager's global search AJAX endpoint (/ajaxsearch.php) dispatches the user-supplied term parameter to more than ten module-specific search handlers (Articoli, Ordini, DDT, Fatture, Preventivi, Anagrafiche, Impianti, and others), each of which…
Multiparty Denial of Service via Prototype-Pollution Field Name (CVE-2026-8161)
multiparty@4.2.3 and earlier store parsed multipart field names and files in plain JavaScript objects and rely on ordinary property lookup (fields[name], files[name]) to detect whether a field has been seen before. Because plain-object lookups traverse the…
Marlin Firmware M421 G-code Handler Out-of-Bounds Write — CVE-2026-56111
Marlin's M421 G-code handler, used to set Mesh Bed Leveling (MBL) grid points, validates only that the supplied I/J grid indices are non-negative and never checks the upper bound against the actual mesh grid size. The underlying setz() function then writes…
Linux Kernel ICMP Fragmentation-Needed NULL Pointer Dereference (CVE-2026-23398)
CVE-2026-23398 is a NULL pointer dereference in the Linux kernel's ICMP handling path, reachable when a host has net.ipv4.ipnopmtudisc set to 3 (a hardened Path MTU Discovery mode) and receives a crafted ICMP "Fragmentation Needed" (type 3, code 4) packet.…
ChatterBot Denial of Service via SQLAlchemy Connection Pool Exhaustion (CVE-2026-23842)
ChatterBot's default SQLAlchemy storage adapter uses an unbounded/default QueuePool configuration with no concurrency throttling, request rate limiting, or explicit session lifecycle management. When many threads call getresponse() concurrently, each checks…
BIRD/BIRD2 BGP AS_PATH Mask Matching Stack Buffer Overflow (CVE-2026-49943)
This repository documents a stack-based buffer overflow in BIRD's BGP ASPATH mask matching code (aspathmatch() in nest/a-path.c). The function uses a fixed-size stack array of 2048 + 1 pmpos entries, but parsepath() expands ASPATH segments from a received BGP…
Apache HTTP Server HTTP/2 HPACK Cookie-Merging Memory Bomb (CVE-2026-49975)
CVE-2026-49975 is a denial-of-service vulnerability in Apache HTTP Server's HTTP/2 request handling. A small HPACK-encoded HTTP/2 header block can reference the HPACK dynamic-table entry for the cookie header many times (up to the request field limit), which…
Algorithmic Complexity DoS in musl libc `iconv` GB18030 Decoder — CVE-2026-6042
musl libc's GB18030 4-byte decoder (src/locale/iconv.c) contains a gap-skipping loop that, for each decoded character, iterates the entire 23,940-entry gb18030[126][190] lookup table to resolve a linear index to a Unicode codepoint. A crafted 4-byte sequence…
Nmap IPv6 Extension-Header Length Wrap
The Nmap IPv6 extension-header parser in libnetutil/netutil.cc advances a payload pointer by an attacker-declared extension-header length without first checking that the advanced pointer stays within the bounds of the captured packet. When a crafted,…