Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-59939

  CVE-2026-59939: httplib2 Decompression Bomb Denial of Service

  A malicious HTTP server can send httplib2 a tiny gzip or deflate response that expands to hundreds of megabytes in memory, crashing the client process with no authentication required.

• high

  CVE-2026-25800: quinn-proto Unbounded Stream Reassembly Memory Exhaustion

  Any remote peer can crash a Quinn-based server or client by sending deliberately fragmented QUIC stream data with many gaps, forcing the receiver to buffer an unbounded number of out-of-order…

• highCVE-2026-54673

  CVE-2026-54673: builder-util-runtime Cross-Origin Redirect Credential Leak

  The electron-updater HTTP redirect handler only stripped credentials from headers named exactly 'authorization' in lowercase, allowing GitLab personal access tokens and mixed-case Authorization…

• highCVE-2026-55575

  CVE-2026-55575: LiquidJS pop Filter memoryLimit Accounting Bypass

  The pop array filter in LiquidJS allocates a full clone of its input without counting that allocation against the configured memoryLimit, letting an attacker silently blow past the memory cap that…

• highCVE-2026-55685

  CVE-2026-55685: react-router Unauthenticated DoS via Inefficient Route Matching on Manifest Endpoint

  Unauthenticated attackers can send crafted requests to the React Router manifest endpoint to repeatedly trigger expensive route-regex compilation, causing severe CPU load and degraded response times…

• highCVE-2026-47219

  CVE-2026-47219: find-my-way Prototype Property Lookup DoS via HTTP/2 Method

  Sending an HTTP/2 request with a method name like 'constructor' or 'toString' crashes any Node.js server using find-my-way as its router, because the router looks up the method name on a plain object…

• highCVE-2026-59936

  CVE-2026-59936: pypdf Infinite Loop via Unterminated Inline Image

  A crafted PDF with an inline image that has no closing EI marker can lock any pypdf-based app in an infinite loop, making it trivially exploitable for denial of service.

• highCVE-2026-59935

  CVE-2026-59935: pypdf Infinite Loop via Unterminated ASCII85/ASCIIHex Inline Image

  A crafted PDF with an unterminated inline image using the ASCII85 or ASCIIHex filter causes pypdf to spin in an infinite loop, hanging any process that extracts page text.

• highCVE-2026-59931

  CVE-2026-59931: PHPSpreadsheet SSRF Whitelist Bypass via HTTP Redirect in WEBSERVICE()

  A crafted XLSX file can use the WEBSERVICE() formula to bounce an HTTP request through any whitelisted domain that issues a redirect, reaching internal services that the domain whitelist was meant to…

• highCVE-2026-59932

  CVE-2026-59932: PHPSpreadsheet Gnumeric Reader Gzip Bomb (DoS)

  Uploading a tiny crafted .gnumeric file to any app using PHPSpreadsheet can crash the PHP worker by tricking the Gnumeric reader into expanding a gzip bomb with no size limit, exhausting server…

• highCVE-2026-59933

  CVE-2026-59933: PHPSpreadsheet OLE Sector-Chain Infinite Loop (DoS)

  A tiny malformed .xls file can make PHPSpreadsheet loop forever and exhaust all server memory, crashing PHP even during a routine file-type check.

• highCVE-2026-45623

  CVE-2026-45623: PostCSS Arbitrary File Read via sourceMappingURL Path Traversal

  PostCSS blindly reads any local file path embedded in a CSS comment and leaks its first bytes through an error message, letting an attacker read server secrets from any app that processes untrusted…