denialdisk·Oct 23Hunting Thread Exhaustion: Ischemia for HTTP/1.1 Partial-Entity HoldsHowdy cowboys! This write-up is a quick note about how and why I developed this tool. Although I’ve been using a version of this internally…
Sahadat Husain·Oct 8Image decompression bombs: a 400-megapixel upload on a small serverWhat a huge image really costs in memory, how to tell an attack from a real photo, and how to process one in about 1 GiB, measured.
Bholay Nath Singh·Sep 4PNG Decompression Bomb: How a Tiny Image Can Bring Down a Document AI PipelineWhen we talk about security testing an AI application, our first thoughts usually go towards things like prompt injection, data leakage…
ahmad kabiri·Aug 22Why Rate Limiting Is Not Enough Against DoS AttacksThree kinds of DoS vulnerability, and why rate limiting is not enough.
MEHDI KR·Aug 18Tales of a CSDoS: How a Single Malformed JSON String Broke an Entire Event PlatformBy Mehdi (MadaraHaxor)
