Deep dives into vulnerabilities, exploit dev, and security research.
An unauthenticated heap-based buffer overflow in cupsd allows for remote denial-of-service. This research explores the size calculation discrepancy in URI attribute handling.
A critical oversight in Netty's HTTP/2 implementation allows for unbounded CONTINUATION frames, leading to CPU exhaustion and connection monopolization. This research explores how 0-byte fragments bypass existing byte-level constraints.
An integer overflow vulnerability in nginx's MP4 module allows for heap out-of-bounds reads and potential DoS. This post details how large entry counts bypass security checks on 32-bit platforms.
Read Write-up →UTF8DataInputJsonParser bypasses nesting depth limits, potentially causing StackOverflowErrors and DoS. This post details how direct parsing context creation skips critical depth validation.
Read Write-up →The async JSON parser in jackson-core fails to enforce maxNumberLength constraints, leading to memory and CPU exhaustion. This research explores the missing validation step in the non-blocking code path.
Read Write-up →