Zion Boggan - Security Research

A certificate path-length limit that vanishes when you remove an unrelated field

Sat, 18 Apr 2026 09:00:00 +0000

A widely-deployed open-source crypto library enforces an RFC 5280 CA path-length constraint only when a separate extension is present, so a CA forbidden from delegating can mint rogue sub-CAs the library still trusts. Includes an interactive proof you can run in the browser.

Missing Channel-Level Authorization in Shared Channel Invite/Uninvite API Allows Private Channel Data Exfiltration

Sat, 18 Apr 2026 09:00:00 +0000

Mattermost shared-channel invite endpoint enforces system-level perms but not channel-level. Same bug class as CVE-2025-11777.

sequoia-pgp hunt, iteration 3 (RUSTSEC-2024-0345 variant audit)

Fri, 17 Apr 2026 09:00:00 +0000

Iteration 3: results and what would not be a finding.

sequoia-pgp hunt, iteration 2 (stream.rs read-after-verify-fail)

Fri, 17 Apr 2026 09:00:00 +0000

Iteration 2: parser audit and candidate ranking.

sequoia-pgp hunt, iteration 1 (recon)

Fri, 17 Apr 2026 09:00:00 +0000

Recon and variant-seed inventory against sequoia-openpgp based on its historical RUSTSEC advisories.

openpgpjs-v6 hunt, iteration 1

Fri, 17 Apr 2026 09:00:00 +0000

Root-cause walk-through of CVE-2025-47934 (signature-verification bypass via msg.packets mutation) and a variant search against the v6.2.0 compression refactor.

Live audit log, started 2026-04-17 00:10 UTC

Fri, 17 Apr 2026 09:00:00 +0000

Top-to-bottom audit log of systemd-coredumpd and systemd-resolved DNS parser. No findings; the writeup is the methodology and the dead ends.

QBFT HasBadProposal Quorum Inconsistency, Consensus Liveness Violation

Thu, 16 Apr 2026 09:00:00 +0000

QBFT's HasBadProposal check is symmetric across the round, one prepared bad proposal halts the round for every validator.

CVE-2024-32972: Integer Underflow in GetBlockHeaders Causes Full Network Denial of Service

Thu, 16 Apr 2026 09:00:00 +0000

N-day demonstration of CVE-2024-32972 against an unpatched go-ethereum fork. Single unauthenticated TCP packet causes 7.8 GB allocation, OOM-kills the node. Targeting all IBFT validators halts the entire chain.

Replication Integrity Bypass via Lua `redis.set_repl(REPL_NONE)` Enables Silent Data Corruption and Persistent Backdoor Functions on Aiven Managed Valkey

Wed, 15 Apr 2026 09:00:00 +0000

Valkey replication stealth path bypasses listpack validation.

Aiven Internal System Account Password Hashes Exposed to Customer Users via mysql.user SELECT on Aiven Managed MySQL

Wed, 15 Apr 2026 09:00:00 +0000

MySQL binlog ACL bypass surfaces replication credentials.

Report: aiven_gatekeeper Bypass via Implicitly Castable Argument Types

Tue, 14 Apr 2026 09:00:00 +0000

aiven_gatekeeper extension bypassed via implicit-cast-driven shadow functions.

Report: Unqualified `parse_ident()` in SECURITY DEFINER Function (CVE-2025-31480 Variant)

Tue, 14 Apr 2026 09:00:00 +0000

parse_ident without schema qualification inside SECDEF: variant of CVE-2025-31480 territory.

Report: Autovacuum Arbitrary Code Execution via Expression Index Shadow Functions

Tue, 14 Apr 2026 09:00:00 +0000

Autovacuum executes attacker-defined function under the SECURITY_RESTRICTED bypass path.

ASLR Bypass via Lua Function Pointer Leak in Aiven Managed Valkey

Tue, 14 Apr 2026 09:00:00 +0000

ASLR leak through replication metadata.

Unauthenticated RTSP Video Stream Access via ONVIF WebSocket Endpoint

Mon, 13 Apr 2026 09:00:00 +0000

ONVIF RTSP-over-WebSocket endpoint accessible without authentication.

SSRF via httptest.cgi IPv6-Mapped Loopback Address Bypass

Mon, 13 Apr 2026 09:00:00 +0000

IPv6-mapped IPv4 (::ffff:127.0.0.1) bypasses the IPv4-only loopback filter on httptest.cgi.

Report: Superuser Database Connection via SECURITY DEFINER dblink Chain

Mon, 13 Apr 2026 09:00:00 +0000

SECURITY DEFINER + dblink loopback chain reaches an unrestricted superuser session.

Report: Privilege Boundary Violation via Subscription Ownership Escalation

Mon, 13 Apr 2026 09:00:00 +0000

Postgres CREATE SUBSCRIPTION executes under session_user=postgres, escalating sandboxed user to superuser context.

Missing Input Validation in dnsupdate.cgi Delete Path

Mon, 13 Apr 2026 09:00:00 +0000

dnsupdate.cgi delete path skips the input validation applied to add.

Authenticated DoS: Karapace REST Proxy Crash via GZIP Compression Bomb in Kafka Messages

Mon, 13 Apr 2026 09:00:00 +0000

Karapace REST proxy accepts gzip-compressed messages and decompresses without bounds.

Authenticated DoS: Dragonfly Server Crash via Crafted Stream RESTORE Payload

Mon, 13 Apr 2026 09:00:00 +0000

Unbounded allocation in Dragonfly's stream RESTORE path.

Stack Overflow in JSONMergePatch Crashes Aiven Managed ClickHouse via Single SELECT Query

Sun, 12 Apr 2026 09:00:00 +0000

Single SELECT JSONMergePatch(...) SIGSEGVs the managed instance. Crash payload is storable in shared tables.

Server-Side Request Forgery via pingtest.cgi Missing Address Validation

Sun, 12 Apr 2026 09:00:00 +0000

pingtest.cgi skips the camera's own validateaddr helper.

SNMP Community String Disclosure to Viewer-Privileged Users via DeviceConfig1 API

Sun, 12 Apr 2026 09:00:00 +0000

SNMP community strings returned in the viewer-role config endpoint.

Fireblocks MPC-Lib Audit Summary