Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• criticalCVE-2025-59953

  CVE-2025-59953: lmdeploy Remote Code Execution via Pickle Deserialization in AsyncRPCServer

  LMdeploy's internal RPC server deserializes incoming ZMQ messages with pickle.loads() and no authentication, letting any network-reachable attacker run arbitrary code on the host by sending a crafted…

• highCVE-2026-61593

  CVE-2026-61593: djust Cross-Site Request Forgery via Server-Sent Events Transport

  A malicious web page can silently hijack a logged-in user's djust LiveView session over the SSE transport, forcing their browser to mount a LiveView and fire state-changing event handlers as the…

• criticalCVE-2026-61560

  CVE-2026-61560: @zereight/mcp-gitlab Unauthenticated Arbitrary File Read via Path Traversal

  The popular GitLab MCP server exposes every tool over HTTP with no authentication in its default Docker configuration, and one of those tools reads any file from the server's disk, letting anyone on…

• highCVE-2026-61590

  CVE-2026-61590: djust Unauthenticated Observability Endpoint Exposure

  djust's built-in debug endpoints, including a remote method invocation handler, were reachable from any network client when DEBUG was on and the optional localhost middleware was not installed…

• high

  @zereight/mcp-gitlab: GraphQL Read-Only Bypass, Unauthenticated Transports, and Session-Exhaustion DoS

  The most popular GitLab MCP server lets an LLM agent or any network client bypass the read-only guard, ignore project allow-lists, use GitLab credentials without authentication, and exhaust server…

• criticalCVE-2026-61568

  CVE-2026-61568: @zereight/mcp-gitlab DNS Rebinding via Missing Host/Origin Validation

  A malicious web page can use DNS rebinding to reach a locally running @zereight/mcp-gitlab Streamable HTTP server and interact with GitLab MCP tools, because the server never checks the Host or…

• criticalCVE-2026-61559

  CVE-2026-61559: @zereight/mcp-gitlab Server-Side Request Forgery via X-GitLab-API-URL Header

  When dynamic API URL support is enabled, any caller can redirect the GitLab MCP server's outbound API calls to an attacker-controlled host and steal the server's GitLab token in a single request.

• highCVE-2026-69202

  CVE-2026-69202: http4s Ember HTTP/2 Unbounded Inbound Body Buffering DoS

  Any Ember HTTP/2 server or client can be crashed out-of-memory by a peer that streams a large body faster than the application reads it, because flow-control windows are replenished based on bytes…

• highCVE-2026-69203

  CVE-2026-69203: http4s Ember HTTP/2 Unbounded Stream Allocation DoS

  Any http4s Ember server with HTTP/2 enabled will accept an unlimited number of concurrent streams from a single unauthenticated connection, letting an attacker exhaust server heap memory and crash…

• criticalCVE-2026-69204

  CVE-2026-69204: http4s Ember CL.TE HTTP Request Smuggling

  http4s Ember's HTTP/1.1 parser accepted requests that carried both Transfer-Encoding and Content-Length at the same time, letting an attacker smuggle a hidden request through a reverse proxy and…

• highCVE-2026-69205

  CVE-2026-69205: http4s Ember Transfer-Encoding Case-Sensitive Parsing HTTP Request Smuggling

  http4s Ember compared the Transfer-Encoding header value with a case-sensitive substring match, so a value like 'Chunked' (capital C) was silently ignored, letting an attacker trick a front-end proxy…

• highCVE-2026-69208

  CVE-2026-69208: http4s DigestAuth Nonce Map Unbounded Growth (DoS)

  A logic bug in http4s DigestAuth middleware causes the server's nonce map to grow forever, letting any unauthenticated attacker exhaust JVM heap memory by flooding DigestAuth-protected endpoints.