Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-49866

  CVE-2026-49866: @libp2p/gossipsub CPU DoS via Oversized IHAVE and IWANT Control Messages

  Any node running @libp2p/gossipsub with default settings can be forced to burn its entire CPU on a single malicious peer's oversized control messages, because the library placed no limit on how many…

• highCVE-2026-49851

  CVE-2026-49851: mistune Quadratic-Time DoS in parse_link_text

  Sending a few thousand open-bracket characters to any app that parses user Markdown with mistune causes the CPU to spin for seconds, making denial-of-service trivially cheap.

• highCVE-2026-48594

  CVE-2026-48594: Tesla Middleware Decompression Bomb (DoS)

  The Tesla HTTP client library for Elixir will blindly decompress any server response with no size limit, so an attacker who controls a server can crash or freeze any app that uses its decompression…

• highCVE-2026-48597

  CVE-2026-48597: Tesla Mint Adapter BEAM Atom Table Exhaustion via Untrusted URL Scheme

  Tesla's Mint adapter converts attacker-controlled URL schemes into permanent BEAM atoms with no validation, letting anyone crash an Elixir application by flooding it with ~1 million unique scheme…

• highCVE-2026-49754

  CVE-2026-49754: Mint HTTP/2 CONTINUATION Flood Memory Exhaustion

  A malicious HTTP/2 server can crash any Elixir process using Mint by sending an endless stream of CONTINUATION frames, filling the client's memory with no limit until the BEAM process dies.

• highCVE-2026-48862

  CVE-2026-48862: Mint HTTP/2 Client Memory Exhaustion via PUSH_PROMISE Flood

  A malicious HTTP/2 server can crash any Elixir process using Mint by flooding it with PUSH_PROMISE frames and never sending the matching response headers, causing unbounded memory growth with no way…

• criticalCVE-2026-52766

  CVE-2026-52766: YesWiki Unauthenticated Arbitrary Page Deletion

  Any anonymous visitor of a default YesWiki install can permanently delete any wiki page, including the front page, by abusing the unguarded spam-cleanup action.

• highCVE-2026-52767

  CVE-2026-52767: YesWiki ActivityPub Signature-Verification Bypass

  A logic flaw in YesWiki's ActivityPub inbox lets any unauthenticated attacker create, update, or delete wiki entries by sending a crafted HTTP request with a junk signature that PHP's openssl_verify…

• highCVE-2026-52769

  CVE-2026-52769: YesWiki Unauthenticated SSRF via ActivityPub Signature keyId

  An unauthenticated attacker can trick YesWiki into making arbitrary outbound HTTP requests to any host, including internal cloud metadata endpoints, by setting the keyId field in an HTTP Signature…

• highCVE-2026-52770

  CVE-2026-52770: YesWiki Bazar API Unauthenticated Boolean-Based SQL Injection

  Any unauthenticated visitor can inject SQL into YesWiki's public Bazar entry-listing API by abusing numeric field filters, turning the API into a boolean oracle that leaks database contents…

• highCVE-2026-52771

  CVE-2026-52771: YesWiki Second-Order SQL Injection in Page Delete API

  A low-privilege authenticated user can create a wiki page with a SQL-laden tag, then trigger a delete request that injects that tag unescaped into a live database query, exposing all data the wiki…

• criticalCVE-2026-52778

  CVE-2026-52778: YesWiki CalcField Unsafe eval() Remote Code Execution and ReDoS

  YesWiki's Bazar form calculator passes user-supplied math formulas through a broken regex check and then directly into PHP eval(), letting an attacker crash the server or run arbitrary system…