{"vulnerability": "cve-2026-5343", "sightings": [{"uuid": "d1022762-31b0-406a-bd94-51cb45bbfa5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5343", "type": "seen", "source": "https://www.drupal.org/sa-contrib-2026-031", "content": "", "creation_timestamp": "2026-04-02T02:00:04.000000Z"}, {"uuid": "c096a5f4-694a-42c4-ab41-913421320313", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53431", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrurapjhtq2v", "content": "CVE-2026-53431 - boruta\nA security weakness in Boruta allows attackers to use expired login credentials to pretend to be a trusted client. This can happen if an attacker gets hold of a valid login token and uses\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#boruta #Hex #CVE #infosec", "creation_timestamp": "2026-07-30T15:34:05.571127Z"}, {"uuid": "eab091cb-6f36-4aa7-b3ac-5d9554732a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5343", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mmxa6got322o", "content": "Drupal SAML SSO - Service Provider (before 3.1.4) has a HIGH severity privilege escalation vuln. No patch; monitor advisories for updates. Stay vigilant! \ud83d\udea8 https://radar.offseq.com/threat/cve-2026-5343-cwe-754-improper-check-for-unusual-o-7182465d #OffSeq #Drupal #Security", "creation_timestamp": "2026-05-29T00:00:37.451583Z"}, {"uuid": "143ad652-7370-4720-b9e7-b50215c1f9a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-5343", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116654921132291224", "content": "\u26a0\ufe0f HIGH severity: CVE-2026-5343 in Drupal SAML SSO - Service Provider (pre-3.1.4) allows privilege escalation via improper exception checks. No patch or exploits yet. Monitor advisories for updates. https://radar.offseq.com/threat/cve-2026-5343-cwe-754-improper-check-for-unusual-o-7182465d #OffSeq #Drupal #Vuln #SAML", "creation_timestamp": "2026-05-29T00:00:45.780213Z"}, {"uuid": "78f9c087-fddd-4894-bcd1-10afa0468284", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53438", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnwxybdq6t2p", "content": "CVE-2026-53438 - Jenkins Missing Permission Check Allows Unauthorized Queue Item Cancellation\nCVE ID : CVE-2026-53438\n \n Published : June 10, 2026, 2:16 p.m. | 23\u00a0minutes ago\n \n Description : A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allo...", "creation_timestamp": "2026-06-10T14:59:11.672495Z"}, {"uuid": "05190cf6-e220-4703-a30f-473edf1240c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53439", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnwyduf4sh2r", "content": "CVE-2026-53439 - Jenkins Information Disclosure\nCVE ID : CVE-2026-53439\n \n Published : June 10, 2026, 2:16 p.m. | 23\u00a0minutes ago\n \n Description : Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to det...", "creation_timestamp": "2026-06-10T15:07:24.633594Z"}, {"uuid": "e809b6ea-497c-4658-a5b6-8e1210c468f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3modcbjerdi2q", "content": "Jenkins\u306eRCE\u8106\u5f31\u6027\u3001\u91ce\u5916\u3067\u306e\u7a4d\u6975\u7684\u306a\u60aa\u7528\u3092\u78ba\u8a8d\n\nJenkins\u306b\u304a\u3051\u308b\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\uff08RCE\uff09\u8106\u5f31\u6027\u300cCVE-2026-53435\u300d\u304c\u3001\u73fe\u5728\u91ce\u5916\u3067\u7a4d\u6975\u7684\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059\u3002 \u3053\u306e\u8106\u5f31\u6027\u306f\u3001Jenkins\u306econfig.xml\u51e6\u7406\u306b\u304a\u3051\u308b\u5b89\u5168\u3067\u306a\u3044\u30c7\u30b7\u30ea\u30a2\u30e9\u30a4\u30bc\u30fc\u30b7\u30e7\u30f3\u306b\u8d77\u56e0\u3059\u308b\u3082\u306e\u3067\u3001\u8a8d\u8a3c\u306a\u3057\u3001\u307e\u305f\u306f\u4f4e\u6a29\u9650\u306e\u653b\u6483\u8005\u304c\u8106\u5f31\u306a\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u4e0a\u3067\u4efb\u610f\u306e\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d", "creation_timestamp": "2026-06-15T12:35:16.319902Z"}, {"uuid": "beaa97f7-519c-4bb1-8641-7e63d5a07bce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-53435", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3modcvycfss2c", "content": "CVE-2026-53435: Inside the Jenkins Deserialization Chain That\u2019s Being Exploited Right\u00a0Now\n\nCVE-2026-53435 is a high-severity Jenkins deserialization flaw (CVSS 8.8) under active exploitation. Full technical breakdown: gadget\u2026\n\nhttps://thecybersecguru.com/news/cve-2026-53435-jenkins-deserialization/", "creation_timestamp": "2026-06-15T12:46:49.034588Z"}, {"uuid": "7689fe6a-94b6-42c5-ba9e-51f7a362ae31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3modduvaaya2u", "content": "Jenkins Under Siege: Critical CVE-2026-53435 Actively Exploited in Real-Time Attacks as Global Infrastructure Faces Silent Takeover Attempts +\u00a0Video\n\nIntroduction: A Silent Crack Appears in the Backbone of DevOps Automation A new wave of cybersecurity concern is sweeping through DevOps environments\u2026", "creation_timestamp": "2026-06-15T13:04:00.577638Z"}, {"uuid": "ff1aa007-2879-483f-8529-c48465a80d0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3moejpxt2zv2j", "content": "Jenkins\u306e\u30ea\u30e2\u30fc\u30c8\u30b3\u30fc\u30c9\u5b9f\u884c\uff08RCE\uff09\u8106\u5f31\u6027CVE-2026-53435\u304c\u73fe\u5728\u60aa\u7528\u3055\u308c\u3066\u3044\u307e\u3059 \n\nJenkins RCE Vulnerability CVE-2026-53435 Now Under Active Exploitation  #DailyCyberSecurity (Jun 15)\n\nsecurityonline.info/jenkins-rce-...", "creation_timestamp": "2026-06-16T00:21:17.854761Z"}, {"uuid": "b24cf258-970d-4822-aaaa-5d11951c1dc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53430", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moekog4et52f", "content": "CVE-2026-53430 - grpc gzip decompression bomb in GRPC.Compressor.Gzip.decompress/1\nCVE ID : CVE-2026-53430\n \n Published : June 15, 2026, 11:16 p.m. | 25\u00a0minutes ago\n \n Description : Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in elixir-grpc g...", "creation_timestamp": "2026-06-16T00:38:18.976219Z"}, {"uuid": "9d4e8801-f740-485e-bcef-fdc9406e3662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://bsky.app/profile/rxerium.com/post/3mofeg6jzuc2t", "content": "\ud83d\udea8 CVE-2026-53435, a high severity (CVSS 8.8) deserialization vulnerability in Jenkins is now seeing active exploitation as per \n@DefusedCyber\n.\n\nScan your infrastructure: \ngithub.com/rxerium/rxer...\n\nPatches are available per the vendor advisory: jenkins.io/security/adv...", "creation_timestamp": "2026-06-16T08:19:02.294195Z"}, {"uuid": "030af1fe-f780-4978-9f46-3ebe2173d6ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mogzi6qmbk2q", "content": "Jenkins\u306e\u8106\u5f31\u6027(CVE-2026-53435)\u304c\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u3078\u60aa\u7528-PoC\u3082\u516c\u958b\u4e2d\nrocket-boys.co.jp/security-mea...\n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #cyberattack", "creation_timestamp": "2026-06-17T00:08:40.371315Z"}, {"uuid": "ba84af3a-a2d5-4540-91b8-f7a1e67aaa38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/jenkins-multiple-vulnerabilities_20260617", "content": "", "creation_timestamp": "2026-06-16T18:00:00.000000Z"}, {"uuid": "ae6fc849-1c9d-43bf-b030-0f385ff867b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53436", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/jenkins-multiple-vulnerabilities_20260617", "content": "", "creation_timestamp": "2026-06-16T18:00:00.000000Z"}, {"uuid": "1e75fcc8-2592-4c59-b21c-61b7f79c8a68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53437", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/jenkins-multiple-vulnerabilities_20260617", "content": "", "creation_timestamp": "2026-06-16T18:00:00.000000Z"}, {"uuid": "2d06a1ac-ad51-4a53-b232-9fb72a656e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53438", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/jenkins-multiple-vulnerabilities_20260617", "content": "", "creation_timestamp": "2026-06-16T18:00:00.000000Z"}, {"uuid": "346ab149-f2fb-4ea7-b217-30fe7a59135d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53439", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/jenkins-multiple-vulnerabilities_20260617", "content": "", "creation_timestamp": "2026-06-16T18:00:00.000000Z"}, {"uuid": "098fbcc7-48c2-49f6-8005-20f465d86a13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-nuove-vulnerabilita-in-jenkins-1", "content": "", "creation_timestamp": "2026-06-10T07:43:47.000000Z"}, {"uuid": "7ccb43d7-5fd8-429a-9c12-2848a2130bc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mojx72mocc27", "content": "The latest update for #Foresiet includes \"Inside CVE-2026-53435: Authenticated Deserialization to Full Controller Takeover in Jenkins via config.xml\" and \"The Month the AI Supply Chain Broke: Six #Cybersecurity Incidents That Shook May 2026\".\n \n#infosec https://opsmtrs.com/3J3CMGz", "creation_timestamp": "2026-06-18T04:05:46.416878Z"}, {"uuid": "51d54788-0be3-460b-8f80-52c5854af124", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "published-proof-of-concept", "source": "Telegram/8OrsKfIYkEk0-8uPkb8MstgNwn2ZcQVuOnxP5IJIO77AEwY", "content": "", "creation_timestamp": "2026-06-12T21:00:04.000000Z"}, {"uuid": "26f03cba-0dc8-4059-81e6-9a67c761d267", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a0d591ce-8b4a-43ca-a36f-8b2c7052e973", "content": "", "creation_timestamp": "2026-06-19T12:45:05.708001Z"}, {"uuid": "aee04e34-eefc-420d-ada5-76669d53ca8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "Cve-2026-53435", "type": "seen", "source": "https://bsky.app/profile/mineabot.xyz/post/3morblcrzr72o", "content": "Cve-2026-53435 pairs a Jenkins deserialization chain with a public PoC and a patch. With working exploit code in the open, the window to patch has effectively closed. Treat CI controllers as priority infrastructure and update now.\n\n#devops #kubernetes #platform", "creation_timestamp": "2026-06-21T02:00:07.709360Z"}, {"uuid": "2ab964e4-03bc-4430-b490-914cc00f394f", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7c04c96c-3f75-4977-9e20-76ebc2722fa6", "content": "", "creation_timestamp": "2026-06-23T14:02:57.490713Z"}, {"uuid": "bdf5b80c-bb40-4ef3-b088-5e5a9e81ec1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mpfmiio4tu2l", "content": "The latest update for #Foresiet includes \"TP-Link CVE-2026-3227: Authenticated Command Injection via Configuration Import\" and \"Inside CVE-2026-53435: Authenticated Deserialization to Full Controller Takeover in Jenkins via config.xml\".\n \n#cybersecurity #infosec https://opsmtrs.com/3J3CMGz", "creation_timestamp": "2026-06-29T04:08:44.017102Z"}, {"uuid": "e086c15e-78ef-4d9b-8fce-3a06f0ea526d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://bsky.app/profile/malwareobserver.bsky.social/post/3mphh7h4ldu2c", "content": "\ud83d\udc1b VULNERABILITIES CVE Notify: \ud83d\udea8 [CVE-2026-53434](https://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk)\nDetection of E...\nhttps://lists.apache.org/thread/x510lbq0sfrd1qyo7q3r1mpllgpdcosk #ZeroDay #PatchManagement #Vulnerability", "creation_timestamp": "2026-06-29T21:39:26.192303Z"}, {"uuid": "e7138261-db9e-4f46-9c7d-343c414bb035", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mphjomprh623", "content": "CVE-2026-53434: Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector", "creation_timestamp": "2026-06-29T22:23:42.833734Z"}, {"uuid": "2e00b132-12a4-4b24-a775-6abef5e5fa11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mphma4bkjw2x", "content": "CVE-2026-53434 - Apache Tomcat: Invalid CRL configuration doesn't trigger failure for FFM Connector\nCVE ID : CVE-2026-53434\n \n Published : June 29, 2026, 8:41 p.m. | 1\u00a0hour, 5\u00a0minutes ago\n \n Description : Detection of Error Condition Without Action vulnerability in Apache Tomc...", "creation_timestamp": "2026-06-29T23:09:17.271114Z"}, {"uuid": "c745d4a0-e17f-4c45-ae4e-79e6e1faba79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mphmrch6va2g", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-53434 \u0432 Apache Tomcat: \u0447\u0442\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u043e\u0435 \u0438 \u043a\u0430\u043a \u0435\u0451 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c\n\n\n\nhttps://kripta.biz/posts/BA7E8B9D-324D-4C68-BF21-1840F5E9FA57", "creation_timestamp": "2026-06-29T23:18:54.107080Z"}, {"uuid": "9cb0a8b6-6d14-4c9a-920d-94639edf9de1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mphowseatc25", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-53434 \u0432 Apache Tomcat: \u0447\u0442\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u043e\u0435 \u0438 \u043a\u0430\u043a \u0435\u0451 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c\n\n\n\nhttps://kripta.biz/posts/637BE925-1C67-4011-B165-B4305BC7C4C3", "creation_timestamp": "2026-06-29T23:57:45.699838Z"}, {"uuid": "4cb0d019-5d7b-4d57-a98e-fc385bb91be6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3mphtbl5efc23", "content": "Apache Tomcat\u306e\u8106\u5f31\u6027(Important: CVE-2026-55957, Moderate: CVE-2026-55956, Low: CVE-2026-55955, CVE-2026-55276, CVE-2026-53434, CVE-2026-53404, CVE-2026-50229)\n\n#sios_tech #security #vulnerability #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u8106\u5f31\u6027 #linux #tomcat #mod_jk #apache\n\nsecurity.sios.jp/vulnerabilit...", "creation_timestamp": "2026-06-30T01:15:24.781331Z"}, {"uuid": "2602ef56-3e13-49ff-8c36-7266c9c5707a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53432", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpj5y5zdxj2j", "content": "CVE-2026-53432 - Integer Overflow in fzf\nCVE ID : CVE-2026-53432\n \n Published : June 30, 2026, 12:01 p.m. | 1\u00a0hour, 45\u00a0minutes ago\n \n Description : fzf is vulnerable to\u00a0Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is\u00a0approximately 2,200,00...", "creation_timestamp": "2026-06-30T13:59:37.599198Z"}, {"uuid": "0cac524b-6566-4e9b-b70d-fa47357abb27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53433", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpj6i7jyks2z", "content": "CVE-2026-53433 - Denial of Service in fzf\nCVE ID : CVE-2026-53433\n \n Published : June 30, 2026, 12:01 p.m. | 1\u00a0hour, 45\u00a0minutes ago\n \n Description : fzf is vulnerable to a Denial of Service (DoS) due to inefficient HTTP body processing in the --listen mode due to inefficient H...", "creation_timestamp": "2026-06-30T14:08:36.358716Z"}, {"uuid": "0201b0a5-fbaa-4300-bd92-7d8ab1ea4567", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mpjajvmcfv2i", "content": "\ud83d\udd17 CVE : CVE-2026-50229, CVE-2026-53404, CVE-2026-53434, CVE-2026-55276, CVE-2026-55955, CVE-2026-55956", "creation_timestamp": "2026-06-30T14:45:19.984808Z"}, {"uuid": "13828186-32ac-4fe8-9c70-6ecb7edcad15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53433", "type": "seen", "source": "https://cert.pl/en/posts/2026/06/CVE-2026-53432", "content": "", "creation_timestamp": "2026-07-01T02:37:36.677384Z"}, {"uuid": "dd4f5a67-6cb8-48ef-9ddd-dac1dd42ff3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53432", "type": "seen", "source": "https://cert.pl/en/posts/2026/06/CVE-2026-53432", "content": "", "creation_timestamp": "2026-07-01T02:37:34.463294Z"}, {"uuid": "85c95799-bd96-46cf-beb9-0a967a17e56c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0817", "content": "", "creation_timestamp": "2026-07-01T02:50:54.968621Z"}, {"uuid": "68ed684f-fd1d-43fd-bf68-1e2e1d994ffa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1944", "content": "", "creation_timestamp": "2026-07-02T09:45:43.345268Z"}, {"uuid": "6a89c212-0ec6-4ca8-935e-dacbd5a9207a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-53434", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpouz2qpu72c", "content": "CVE-2026-53434\nApache Tomcat versions 11, 10, and 9 have a configuration issue that could reveal sensitive information. To fix this, update to the latest version,\u2026\n\nhttps://stackflag.com/vulnerabilities/cve-2026-53434\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-02T20:35:03.434058Z"}, {"uuid": "b3311306-4fbf-44ea-83a1-39354044a8b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpovp4yk6y2c", "content": "CVE-2026-53434\nApache Tomcat versions 11, 10, and 9 have a configuration issue that could reveal sensitive information. To fix this, update to the latest version, specifically 11.0.23, 10.1.56, or 9.0.119.\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-02T20:47:22.792761Z"}, {"uuid": "276c712a-104c-46e0-8f56-e041b0f1b2c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53432", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqjjl7xvl2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-53432 \u0432 fzf: \u043a\u0430\u043a \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0433\u043e \u0447\u0438\u0441\u043b\u0430 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0441\u0431\u043e\u044e\n\n\n\nhttps://kripta.biz/posts/60381200-C144-42D6-A095-98477BDF6A7B", "creation_timestamp": "2026-07-03T12:14:51.285112Z"}, {"uuid": "de640ba0-f0ea-4c36-a633-72f2174db847", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53433", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqjkcxl7r2c", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-53433 \u0432 fzf: \u0443\u0433\u0440\u043e\u0437\u0430 DoS \u0438\u0437-\u0437\u0430 \u043d\u0435\u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/3880E237-138D-41E3-B2F4-CFC7DC366717", "creation_timestamp": "2026-07-03T12:15:16.197863Z"}, {"uuid": "8b147bc2-eb28-437d-a0dd-3974b79402af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpqjv6v2yt2f", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-53434 \u0432 Apache Tomcat: \u0447\u0442\u043e \u044d\u0442\u043e \u0442\u0430\u043a\u043e\u0435 \u0438 \u043a\u0430\u043a \u0435\u0451 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0442\u044c\n\n\n\nhttps://kripta.biz/posts/07DC8F42-6822-4415-B38A-09168E0B696E", "creation_timestamp": "2026-07-03T12:21:20.857926Z"}, {"uuid": "f30d7aa1-f6cb-4d55-8a47-83f70cbda92b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53434", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mpymctwfvu2e", "content": "CVE-2026-53434 - tomcat\nApache Tomcat versions 11, 10, and 9 have a configuration issue that could reveal sensitive information. To fix this, update to the latest version, specifically 11.0.23, 10.1.56, or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#tomcat #Bitnami #CVE #infosec", "creation_timestamp": "2026-07-06T17:26:04.491135Z"}, {"uuid": "d4174888-a231-4fcc-92d1-5d7980231d33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88500", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-53435\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmesianX\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-12 14:53:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAn offensive security researcher + an AI vs. a fresh n-day: building the first public PoC for CVE-2026-53435 in one Friday night. Raw 8h20m log inside.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-12T06:00:04.663856Z"}, {"uuid": "7ae03746-5b65-4b16-9ba0-04602852d2c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88500", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-53435\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AmesianX\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-12 14:53:37\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nAn offensive security researcher + an AI vs. a fresh n-day: building the first public PoC for CVE-2026-53435 in one Friday night. Raw 8h20m log inside.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T00:00:50.559647Z"}, {"uuid": "194babfb-1c12-4ea1-b253-c2a6e278ad1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://t.me/bdufstecru/3253", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 XStream \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Jenkins \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u0443 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a Script Console \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e XML-\u0444\u0430\u0439\u043b\u0430\n\nBDU:2026-08450\nCVE-2026-53435\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707", "creation_timestamp": "2026-07-14T01:00:06.211607Z"}, {"uuid": "474358f9-0401-4543-8d01-7f06e0e35cf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://t.me/bdufstecru/3253", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 XStream \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Jenkins \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430\u043c\u0438 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u043f\u043e\u0434\u043c\u0435\u043d\u0443 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a Script Console \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e XML-\u0444\u0430\u0439\u043b\u0430\n\nBDU:2026-08450\nCVE-2026-53435\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.jenkins.io/security/advisory/2026-06-10/#SECURITY-3707", "creation_timestamp": "2026-07-15T00:00:34.222895Z"}, {"uuid": "63b0f698-ff76-43ed-8a92-5053cc23ce25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-53430", "type": "published-proof-of-concept", "source": "https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w", "content": "", "creation_timestamp": "2026-08-25T20:35:23.059116Z"}, {"uuid": "16619268-4305-4724-a6df-44e8c39cd3bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://t.me/pphm_HackerNews/1485", "content": "\ud83d\udd34 Jenkins Patches High-Severity Flaws That Could Lead to Server Takeover\n\nJenkins has released security updates addressing seven vulnerabilities, including a high-severity deserialization flaw (CVE-2026-53435) that could allow attackers to impersonate users, read arbitrary files, and potentially execute code through the Script Console. Another high-severity issue (CVE-2026-53441) enables stored XSS attacks, while additional flaws include open redirects, permission bypasses, and exposure of plaintext secrets. Organizations running Jenkins 2.567 or earlier and LTS 2.555.2 or earlier are urged to upgrade immediately.", "creation_timestamp": "2026-07-22T05:00:04.353726Z"}, {"uuid": "e8efef64-2df0-453e-b11c-9f11e23545cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53435", "type": "seen", "source": "https://t.me/pphm_HackerNews/1485", "content": "\ud83d\udd34 Jenkins Patches High-Severity Flaws That Could Lead to Server Takeover\n\nJenkins has released security updates addressing seven vulnerabilities, including a high-severity deserialization flaw (CVE-2026-53435) that could allow attackers to impersonate users, read arbitrary files, and potentially execute code through the Script Console. Another high-severity issue (CVE-2026-53441) enables stored XSS attacks, while additional flaws include open redirects, permission bypasses, and exposure of plaintext secrets. Organizations running Jenkins 2.567 or earlier and LTS 2.555.2 or earlier are urged to upgrade immediately.", "creation_timestamp": "2026-07-23T00:00:27.294867Z"}, {"uuid": "2305ee9e-d7a5-4da6-a1ef-715cc299bfc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-53430", "type": "seen", "source": "https://gist.github.com/alon710/54b5d53eeeb09b8b5b899def091e09f5", "content": "# CVE-2026-53430: CVE-2026-53430: Unauthenticated Remote Denial of Service via Gzip Decompression Bomb in elixir-grpc/grpc\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-08-25\n> **Full Report:** https://cvereports.com/reports/CVE-2026-53430\n\n## Summary\nCVE-2026-53430 is a critical uncontrolled resource consumption vulnerability in the elixir-grpc/grpc library. An unauthenticated remote attacker can cause immediate memory exhaustion and system crashes by sending crafted gRPC frames compressed with Gzip, leading to a complete Denial of Service.\n\n## TL;DR\nUnauthenticated remote attackers can crash Elixir-based gRPC servers by sending a small, highly compressed Gzip payload that expands to multiple gigabytes, triggering an Out-Of-Memory crash.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-409\n- **Attack Vector**: Network\n- **CVSS 4.0 Score**: 8.7\n- **EPSS Score**: 0.00348 (0.35% exploitation probability)\n- **Impact**: Complete Denial of Service (OOM Crash)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- elixir-grpc/grpc (Hex package 'grpc')\n- **grpc**: >= 0.4.0, < 1.0.0 (Fixed in: `1.0.0`)\n\n## Mitigation\n\n- Upgrade the elixir-grpc dependency to version 1.0.0 or higher.\n- Transition monolithic :grpc dependency configurations to use the modular :grpc_server package.\n- Apply restrictive request body size limits at the ingress load balancer or reverse proxy layer.\n- Limit concurrent HTTP/2 streams per connection to prevent parallel decompression attacks.\n\n**Remediation Steps:**\n1. Locate the mix.exs configuration file within the Elixir application.\n2. Update the gRPC dependency declarations to target the secure v1.0 releases, using the :grpc_server package.\n3. In corporate configuration files (e.g., config/config.exs), explicitly define the `:max_decompressed_message_length` parameter to enforce strict limits.\n4. Deploy the updated codebase to staging environments and execute unit tests containing compression payloads to verify safe termination.\n\n## References\n\n- [Official Erlef Advisory Page](https://cna.erlef.org/cves/CVE-2026-53430.html)\n- [GitHub Security Advisory (GHSA-6ccx-9c9f-327w)](https://github.com/elixir-grpc/grpc/security/advisories/GHSA-6ccx-9c9f-327w)\n- [Official Fix Commit](https://github.com/elixir-grpc/grpc/commit/1afbab9d57d2a3e16ca9c62ffa4923338ea96cfc)\n- [OSV Vulnerability Entry](https://osv.dev/vulnerability/EEF-CVE-2026-53430)\n- [MITRE CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-53430)\n- [NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-53430)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-53430) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-26T08:31:40.875086Z"}]}