traekfuglene

Re:Ask HN: What are you working on? (May 2026) on Monday May 11, 2026 @10:29AM (#48095473)

Striga (https://www.striga.ai/) - Source code auditing built on artificial intelligence. Auditing source code with local LLMs, ensuring full data sovereignty. The latest noteworthy discovery - Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 (CVE-2026-23918)

CSRF and LDAP injection found and fixed in pac4j security framework

Posted by traekfuglene on Thursday April 02, 2026 @05:05AM
from the pac4j.org dept.

https://www.pac4j.org/blog/security-advisory-pac4j-core-and-ldap.html

( Read More... | 1 comment | 2 points | on HN )

Re:Exploiting a 32-year-old buffer overflow in GNU telnetd (CVE-2026-3... on Wednesday April 01, 2026 @08:13AM (#47599804)

Pre-auth buffer overflow in telnetd's SLC handler, sitting in the codebase since 1994. We used Striga, our AI-driven source code auditing platform, to reproduce the exploitation path and work out the byte constraints. The writeup covers the math for GOT overwrite on 32-bit and why the same approach is provably impossible on 64-bit.

Exploiting a 32-year-old buffer overflow in GNU telnetd (CVE-2026-32746)

Posted by traekfuglene on Wednesday April 01, 2026 @08:13AM
from the striga.ai dept.

https://www.striga.ai/research/pre-auth-rce-in-gnu-inetutils-telnetd

( Read More... | 1 comment | on HN )

Taking Down the Internet's Most Popular HTTP Client with a Single JSON Key

Posted by traekfuglene on Friday March 27, 2026 @06:25AM
from the striga.ai dept.

https://www.striga.ai/research/crashing-axios-with-proto

( Read More... | 2 comments | 8 points | on HN )

Re:Taking Down the Internet's Most Popular HTTP Client with a Single J... on Friday March 27, 2026 @06:25AM (#47540916)

We used Striga to discover a high-severity vulnerability in axios, the most downloaded HTTP client in JavaScript. Any Node.js service that forwards user-controlled JSON through axios can be crashed with a single request. CVE-2026-25639. Patched in 1.13.5.