Denyspakizh-Tob

Language bindings for Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin, and D fail to cap size fields during deserialization. This allows a remote client to send an excessively large length value, triggering unbounded memory allocation without throttling, which can lead to process Out-of-Memory (OOM) and a denial of service.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. The software lacked a limit on the number of pipelined requests that could be queued. An attacker could exploit this by sending pipelined requests to consume excessive amounts of memory, potentially resulting in a Denial of Service (DoS), which is a condition where a system becomes unavailable to its intended users.

An issue exists in the asynchronous HTTP client/server framework where an attacker can send large incomplete websocket frame payloads. This allows the attacker to bypass standard memory use size limits, potentially leading to a Denial of Service (DoS) attack through excessive memory consumption if the web application utilizes WebSocket endpoints.

The `server hostname` TLS SNI (Server Name Indication) check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain using different per-request `server hostname` parameters, subsequent calls may succeed by reusing the existing connection instead of being rejected by the TLS SNI check.

`DigestAuthMiddleware` can send an authentication response after following a cross-origin redirect. If a client follows a redirect to an attacker-controlled domain, the attacker may be able to extract the authentication digest. This scenario likely requires an open redirect or a similar issue on the target domain. The attacker would only receive the digest, meaning credentials could only be extracted if the cryptography is weak or if password reuse occurs.

An issue exists in the C parser of the asynchronous HTTP client/server framework where the `max line size` check can be bypassed in parts of an HTTP request. When using the optimized C parser, which is the default in pre-built wheels, an attacker can send oversized lines through the HTTP parser to consume an excessive amount of memory, potentially resulting in a Denial of Service (DoS), a condition where a system becomes unavailable to its intended users.

During cleanup, a compressed request body can be decompressed into memory in a single chunk. An attacker may send a compressed payload in specific situations that could be decompressed into memory, potentially leading to a Denial of Service (DoS) via a zip bomb, which is a malicious archive designed to crash or freeze the system by expanding to an enormous size upon decompression.

Host-only cookies saved using the `CookieJar.save()` function and subsequently restored via the `CookieJar.load()` function lose their host-only status. This can result in cookies loaded from disk being sent to subdomains that should have been disallowed.

Payload resources are not closed correctly when a client disconnects during a write operation. If a payload utilizes an open file or other limited resources, an attacker can cause temporary resource starvation until the resources are released by garbage collection.