Labs
Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.
- highCVE-2026-61666
CVE-2026-61666: websocket-driver Denial of Service via Malformed Host Header
A remote attacker can crash any Ruby WebSocket server built on websocket-driver by sending a single HTTP upgrade request with a malformed Host header, which triggers an unhandled exception and kills…
- highCVE-2026-59879
CVE-2026-59879: Immutable.js List 32-bit Trie Overflow leading to Denial of Service
A crafted oversized index passed to an Immutable.js List method triggers an infinite loop or heap exhaustion that crashes or permanently hangs the Node.js process with no way to catch the error.
- highCVE-2026-54291
CVE-2026-54291: PostgreSQL JDBC Driver Silent SCRAM Channel-Binding Downgrade
A network attacker who can intercept TLS traffic can silently strip SCRAM channel-binding protection from a PostgreSQL JDBC connection that explicitly requires it, by presenting a server certificate…
- highCVE-2026-47303
CVE-2026-47303: Microsoft.AspNetCore.Authentication.Negotiate LDAP Injection Elevation of Privilege
A flaw in ASP.NET Core's Negotiate authentication handler lets an attacker craft a malicious Kerberos or NTLM username that injects LDAP filter metacharacters, tricking the server into assigning…
- highCVE-2026-47300
CVE-2026-47300: Microsoft.AspNetCore.Authentication.Negotiate Elevation of Privilege via LDAP Role Retrieval
A logic flaw in ASP.NET Core's Negotiate authentication handler lets a low-privileged network attacker gain elevated roles when LDAP is used to look up group membership, because the handler does not…
- highCVE-2026-50526
CVE-2026-50526: Microsoft.NET.Build.Containers Symlink Following Allows Container Image Tampering
A local attacker on a shared machine can replace the .NET SDK container build staging directory with a symlink, causing files they control to be silently bundled into container images built by other…
- highCVE-2026-56170
CVE-2026-56170: ASP.NET Core SignalR Stateful Reconnect Denial of Service
An unauthenticated attacker can exhaust server memory by opening a SignalR connection with stateful reconnect enabled and deliberately withholding ACKs, forcing the server to buffer messages without…
- highCVE-2026-50650
CVE-2026-50650: WPF XAML Code Injection Elevation of Privilege
A specially crafted XAML file fed to a WPF application can trigger code injection that elevates the attacker's privileges on the local Windows system.
- highCVE-2026-50527
CVE-2026-50527: System.Security.Cryptography.Xml EncryptedXml Stack Overflow DoS
Attackers can crash any .NET 8/9/10 service that decrypts XML by sending a crafted EncryptedXml document whose CipherReference transform chain recurses deep enough to overflow the call stack.
- highCVE-2026-54058
CVE-2026-54058: Pillow Out-of-Bounds Read via Undersized McIdas AREA Row Stride
A crafted McIdas AREA image with a manipulated row-stride field tricks Pillow into reading far beyond a memory-mapped file, leaking adjacent process memory or crashing the worker.
- highCVE-2026-59197
CVE-2026-59197: Pillow Heap Out-of-Bounds Write via Integer Overflow in RankFilter
Passing a very large filter size to Pillow's MedianFilter, MinFilter, or MaxFilter triggers a native heap buffer overflow in C code, which can corrupt process memory and potentially be exploited by…
- highCVE-2026-59199
CVE-2026-59199: Pillow Heap Out-of-Bounds Write via Signed Coordinate Overflow
Pillow's image paste, crop, and alpha_composite operations allow an attacker to trigger a heap out-of-bounds write by passing coordinate values near the signed 32-bit integer boundary, corrupting…