https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:13:10 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-349128 EUVD-2026-349128 https://cve.radiocsirt.org/vuln/euvd-2026-349128 https://cve.radiocsirt.org/vuln/fkie_cve-2026-70616 <p>boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts, each malicious request permanently holds one goroutine, one file descriptor, and approximately 50 kB of memory until the server&#39;s file descriptor limit is reached and listener Accept calls fail, halting all tunnel traffic forwarding for all users.</p> <p>boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts, each malicious request permanently holds one goroutine, one file descriptor, and approximately 50 kB of memory until the server&#39;s file descriptor limit is reached and listener Accept calls fail, halting all tunnel traffic forwarding for all users.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-70616 https://cve.radiocsirt.org/vuln/ghsa-5gjj-xq44-85r4 <p>boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts, each malicious request permanently holds one goroutine, one file descriptor, and approximately 50 kB of memory until the server&#39;s file descriptor limit is reached and listener Accept calls fail, halting all tunnel traffic forwarding for all users.</p> <p>boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler performs no map-lookup validity check and receives on a nil channel that blocks forever, with no timeout, no context cancellation, and no server-side reclamation due to absent HTTP server timeouts, each malicious request permanently holds one goroutine, one file descriptor, and approximately 50 kB of memory until the server&#39;s file descriptor limit is reached and listener Accept calls fail, halting all tunnel traffic forwarding for all users.</p> https://cve.radiocsirt.org/vuln/ghsa-5gjj-xq44-85r4