https://poc.intelseclab.com/tags/denial-of-service/Latest proof-of-concept entries.Hugoen-usSun, 12 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56260-crawl4ai-output-path-arbitrary-write/Sun, 12 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-12_cve-2026-56260-crawl4ai-output-path-arbitrary-write/Critical severity (CVSS 9.1) — web · CVE-2026-56260 (GHSA-365w-hqf6-vxfg). Status: PoC — lab (vulnerable-app/) demonstrates genuine unrestricted arbitrary file write; the bundled poc.py scanner is deliberately conservative (writes only to a randomized safe /tmp marker) so it is safe to run against real/production targets. See Notes.. Affects: Crawl4AI — open-source LLM-friendly web crawler/scraper (unclecode/crawl4ai), Docker API server mode. Tags: crawl4ai, ai-web-crawler, docker-api, path-traversal, arbitrary-file-write, cwe-22, unauthenticated, remote, denial-of-service.webCriticalcrawl4aiai-web-crawlerdocker-apipath-traversalarbitrary-file-writecwe-22unauthenticatedremotedenial-of-servicehttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34473-zte-router-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-34473-zte-router-dos/High severity — network · CVE-2026-34473. Status: PoC. Affects: ZTE H-series routers (17+ models, reported as affecting 140K+ devices). Tags: router, firmware, unauthenticated, denial-of-service, iot, zte, cgilua, web-interface.networkHighrouterfirmwareunauthenticateddenial-of-serviceiotztecgiluaweb-interfacehttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-2636-clfs-sys-bsod/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-2636-clfs-sys-bsod/Medium severity — binary · CVE-2026-2636. Status: PoC. Affects: Windows Common Log File System driver (CLFS.sys, version 10.0.22621.5037 used as reference). Tags: clfs, windows-kernel-driver, bsod, denial-of-service, cwe-159, irp, kebugcheckex, unprivileged.binaryMediumclfswindows-kernel-driverbsoddenial-of-servicecwe-159irpkebugcheckexunprivilegedhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26903-tanstack-query-dos-recursion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-26903-tanstack-query-dos-recursion/Medium severity — web · CVE-2026-26903. Status: PoC. Affects: TanStack Query (@tanstack/query-core and framework bindings: react-query, vue-query, solid-query, svelte-query). Tags: tanstack-query, javascript, denial-of-service, stack-overflow, recursion, react, frontend, client-side-dos.webMediumtanstack-queryjavascriptdenial-of-servicestack-overflowrecursionreactfrontendclient-side-doshttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-29781-sliver-c2-mtls-panic/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-29781-sliver-c2-mtls-panic/High severity — network · CVE-2026-29781 (GHSA-hx52-cv84-jr5v). Status: PoC. Affects: Sliver C2 server (BishopFox). Tags: sliver-c2, denial-of-service, nil-pointer-dereference, protobuf, mtls, golang, red-team-tooling.networkHighsliver-c2denial-of-servicenil-pointer-dereferenceprotobufmtlsgolangred-team-toolinghttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-27831-rldns-heap-oob-read-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-27831-rldns-heap-oob-read-dos/Medium severity — binary · CVE-2026-27831. Status: PoC. Affects: rldns 1.3 (open-source DNS server). Tags: dns, heap-overflow, out-of-bounds-read, denial-of-service, rldns, memory-corruption, x86_64.binaryMediumdnsheap-overflowout-of-bounds-readdenial-of-servicerldnsmemory-corruptionx86_64https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-24688-pypdf-outline-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-24688-pypdf-outline-dos/High severity — misc · CVE-2026-24688. Status: PoC. Affects: pypdf (Python PDF library). Tags: pypdf, python, denial-of-service, infinite-loop, malicious-pdf, memory-exhaustion, outline-parsing, cwe-835.miscHighpypdfpythondenial-of-serviceinfinite-loopmalicious-pdfmemory-exhaustionoutline-parsingcwe-835https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-32707-px4-tattu-can-buffer-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-32707-px4-tattu-can-buffer-overflow/High severity (CVSS 7.5) — hardware · CVE-2026-32707 (GHSA-wxwm-xmx9-hr32, CWE-121). Status: PoC. Affects: PX4-Autopilot flight controller firmware, tattu_can driver. Tags: px4, autopilot, can-bus, socketcan, stack-buffer-overflow, drone, uav, denial-of-service.hardwareHighpx4autopilotcan-bussocketcanstack-buffer-overflowdroneuavdenial-of-servicehttps://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-32743-px4-mavlink-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-32743-px4-mavlink-overflow/Medium severity (CVSS 6.5) — hardware · CVE-2026-32743. Status: PoC. Affects: PX4 Autopilot flight controller firmware. Tags: px4, autopilot, mavlink, drone, uav, buffer-overflow, denial-of-service, mavlink-ftp.hardwareMediumpx4autopilotmavlinkdroneuavbuffer-overflowdenial-of-servicemavlink-ftphttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-32945-pjsip-dns-oob-read/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-32945-pjsip-dns-oob-read/Medium severity — network · CVE-2026-32945. Status: PoC. Affects: pjproject (PJSIP library) — used by Asterisk, FreeSWITCH, and other SIP applications. Tags: pjsip, pjproject, dns, heap-oob-read, denial-of-service, asterisk, freeswitch, sip.networkMediumpjsippjprojectdnsheap-oob-readdenial-of-serviceasteriskfreeswitchsiphttps://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21986-virtualbox-shared-folder-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-07-05_cve-2026-21986-virtualbox-shared-folder-dos/Medium severity (CVSS 7.1) — binary · CVE-2026-21986. Status: PoC. Affects: Oracle VM VirtualBox — Shared Folders kernel driver (VBoxMiniRdr, Windows guest). Tags: virtualbox, denial-of-service, kernel-memory-exhaustion, ioctl, shared-folders, windows-driver, non-paged-pool.binaryMediumvirtualboxdenial-of-servicekernel-memory-exhaustionioctlshared-folderswindows-drivernon-paged-poolhttps://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24417-openstamanager-sqli-search-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-24417-openstamanager-sqli-search-dos/High severity — web · CVE-2026-24417. Status: PoC. Affects: OpenSTAManager (devcode-it/openstamanager). Tags: sql-injection, time-based-blind, openstamanager, php, denial-of-service, ajax, authenticated.webHighsql-injectiontime-based-blindopenstamanagerphpdenial-of-serviceajaxauthenticatedhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-8161-multiparty-prototype-pollution-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-8161-multiparty-prototype-pollution-dos/Medium severity — misc · CVE-2026-8161 / GHSA-qxch-whhj-8956. Status: PoC. Affects: multiparty (npm package, multipart/form-data parser). Tags: multiparty, nodejs, prototype-pollution, denial-of-service, cwe-1321, uncaught-exception, multipart-parser.miscMediummultipartynodejsprototype-pollutiondenial-of-servicecwe-1321uncaught-exceptionmultipart-parserhttps://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-56111-marlin-m421-oob-write/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/hardware/2026-07-05_cve-2026-56111-marlin-m421-oob-write/High severity (CVSS 8.3) — hardware · CVE-2026-56111. Status: PoC. Affects: Marlin Firmware (3D printer firmware), builds compiled with MESH_BED_LEVELING. Tags: marlin, 3d-printer, firmware, g-code, out-of-bounds-write, mesh-bed-leveling, denial-of-service, embedded.hardwareHighmarlin3d-printerfirmwareg-codeout-of-bounds-writemesh-bed-levelingdenial-of-serviceembeddedhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-23398-icmp-frag-needed/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-23398-icmp-frag-needed/High severity — network · CVE-2026-23398. Status: PoC. Affects: Linux kernel, icmp_tag_validation() / icmp_unreach() in net/ipv4/icmp.c. Tags: linux-kernel, icmp, denial-of-service, null-pointer-dereference, kernel-panic, pmtu, scapy, remote-dos.networkHighlinux-kernelicmpdenial-of-servicenull-pointer-dereferencekernel-panicpmtuscapyremote-doshttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23842-chatterbot-dos-pool-exhaustion/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23842-chatterbot-dos-pool-exhaustion/High severity (CVSS 7.5) — misc · CVE-2026-23842. Status: PoC. Affects: ChatterBot (Python conversational AI library). Tags: chatterbot, denial-of-service, sqlalchemy, connection-pool-exhaustion, python, cwe-400, resource-exhaustion.miscHighchatterbotdenial-of-servicesqlalchemyconnection-pool-exhaustionpythoncwe-400resource-exhaustionhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-49943-bird-bgp-aspath-stack-overflow/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-49943-bird-bgp-aspath-stack-overflow/High severity (CVSS 3.1) — network · CVE-2026-49943. Status: PoC. Affects: BIRD Internet Routing Daemon (BGP implementation). Tags: bird, bird2, bgp, as-path, stack-buffer-overflow, denial-of-service, routing, dos.networkHighbirdbird2bgpas-pathstack-buffer-overflowdenial-of-serviceroutingdoshttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-49975-apache-http2-cookie-bomb-dos/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-49975-apache-http2-cookie-bomb-dos/High severity — network · CVE-2026-49975. Status: PoC. Affects: Apache HTTP Server (mod_http2). Tags: apache, httpd, http2, hpack, mod_http2, cookie-header, memory-exhaustion, denial-of-service, flow-control.networkHighapachehttpdhttp2hpackmod_http2cookie-headermemory-exhaustiondenial-of-serviceflow-controlhttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-6042-poc/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-6042-poc/High severity (CVSS 7.5) — network · CVE-2026-6042. Status: PoC. Affects: musl libc — iconv implementation (GB18030 and EUC-KR decoders). Tags: musl, libc, iconv, denial-of-service, algorithmic-complexity, gb18030, alpine-linux.networkHighmusllibciconvdenial-of-servicealgorithmic-complexitygb18030alpine-linuxhttps://poc.intelseclab.com/pocs/network/2026-07-03_nmap-ipv6-extension-length-wrap/Fri, 03 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-03_nmap-ipv6-extension-length-wrap/Low severity — network · None assigned as of 2026-07-03. Status: Incomplete PoC. Affects: Nmap — shared packet parsing code (libnetutil/netutil.cc, tcpip.cc). Tags: nmap, ipv6, integer-wraparound, packet-parsing, libnetutil, extension-headers, denial-of-service, research-in-progress.networkLownmapipv6integer-wraparoundpacket-parsinglibnetutilextension-headersdenial-of-serviceresearch-in-progress