Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-59200

  CVE-2026-59200: Pillow PdfParser Decompression Bomb DoS

  A crafted PDF file with a FlateDecode-compressed stream can exhaust all server memory because Pillow's PdfParser passes an attacker-controlled length hint to zlib.decompress() with no cap on actual…

• highCVE-2026-59204

  CVE-2026-59204: Pillow JPEG2000 Tiled Decode Memory Exhaustion

  A crafted multi-tile JPEG2000 image can force Pillow to grow its internal scratch buffer far beyond any single tile's size, exhausting process memory and crashing the decoder.

• highCVE-2026-59205

  CVE-2026-59205: Pillow Controlled Heap Out-of-Bounds Write in ImageCmsTransform.apply()

  Pillow's color-profile transform API writes far more bytes than an output image buffer can hold when the output image's pixel mode does not match the transform's declared output mode, corrupting the…

• highCVE-2026-50524

  CVE-2026-50524: .NET TLS Handshake Denial of Service

  A malformed TLS handshake message can crash or hang any .NET 8, 9, or 10 application that accepts TLS connections, and no authentication is required to trigger it.

• highCVE-2026-50648

  CVE-2026-50648: System.Security.Cryptography.Xml EncryptedXml Denial of Service

  A crafted XML document with deeply nested EncryptedData elements can make .NET's EncryptedXml parser loop recursively until the process runs out of memory or CPU, crashing any app that decrypts…

• highCVE-2026-50528

  CVE-2026-50528: .NET SslStream TLS Authorization Bypass

  A flaw in .NET's SslStream lets a remote, unauthenticated attacker bypass authorization checks on TLS connections, potentially reading confidential data or tampering with protected traffic.

• highCVE-2026-50525

  CVE-2026-50525: System.Security.Cryptography.Xml EncryptedXml Denial of Service

  A crafted encrypted XML document sent to any .NET application using EncryptedXml can exhaust server resources and crash the process, with no authentication required.

• highCVE-2026-54059

  CVE-2026-54059: Pillow PcfFontFile Decompression Bomb Protection Bypass

  Pillow's PCF font loader skips the decompression bomb size check, letting an attacker allocate over 1 GB of heap memory with a ~148-byte crafted font file.

• high

  axios Node HTTP Adapter Prototype Pollution Proxy Hijack via Interceptor Config Cloning

  A prototype-polluted Object.prototype.proxy value can silently redirect Node.js axios requests through an attacker-controlled proxy, exposing Authorization headers, Basic auth credentials, and…

• highCVE-2026-57108

  CVE-2026-57108: .NET Runtime X.509 Certificate Parsing Denial of Service

  A specially crafted X.509 certificate can crash .NET 8, 9, and 10 runtimes on Linux and macOS by triggering a type confusion bug in the native certificate name-info lookup, making any service that…

• highCVE-2026-47302

  CVE-2026-47302: System.Security.Cryptography.Xml EncryptedXml Denial of Service

  A crafted XML document with deeply nested EncryptedData elements can make any .NET application that calls EncryptedXml.DecryptDocument() consume unbounded memory and CPU until it crashes.

• highCVE-2026-54060

  CVE-2026-54060: Pillow FontFile.compile() Decompression Bomb Bypass

  A crafted BDF or PCF font file can make Pillow allocate gigabytes of memory with no safety check, crashing any server that processes untrusted font uploads.