Threats Tagged 'dos'

Three Linux kernel vulnerabilities have been identified and added to CISA's Known Exploited Vulnerabilities catalog. These flaws allow local attackers to cause denial-of-service conditions, memory disclosure, or unauthorized memory modification. The vulnerabilities involve issues in the TLS receive path, AF_ALG socket handling, and bridge Netfilter ebtables SNAT target. Federal agencies are urged to patch these vulnerabilities promptly.

NightmareStresser was a long-running distributed denial-of-service (DDoS) for-hire service active since at least 2022, likely founded in 2016. It enabled nearly one million users to launch thousands of DDoS attacks per hour worldwide, accepting cryptocurrency payments while avoiding attacks on government, education, and hospital domains. The service was disrupted in a coordinated international law enforcement operation called Operation PowerOFF, which seized its domains and aimed to dismantle DDoS-for-hire infrastructures globally. This takedown is part of ongoing efforts by multiple countries to combat DDoS-for-hire services and hold their operators and users accountable.

The U.S. Federal Bureau of Investigation (FBI) seized the domains of NightmareStresser, a long-running distributed denial-of-service (DDoS) for-hire platform. NightmareStresser allowed users to rent botnets composed of compromised routers and IoT devices to launch large-scale DDoS attacks targeting various network layers. The service had over 566,000 registered users and could launch attacks up to 200 Gbps. This takedown was part of Operation PowerOFF, a coordinated international law enforcement effort to dismantle criminal DDoS-for-hire infrastructures worldwide. Previous actions under this operation have led to multiple arrests and domain seizures of similar services. The FBI and other agencies continue to target these platforms to reduce the prevalence of DDoS attacks globally.

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.

An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated remote actor to terminate the consuming application process via a crafted event stream response frame containing a header value type outside the valid range. To remediate this issue, users should upgrade to release-2026-03-23 or later, and patch any forked or derivative code.

CVE-2026-85228 is an integer overflow vulnerability in the tensor buffer validation component of the Deep Java Library (DJL), an open-source Java framework for deep learning maintained by Amazon. The flaw occurs when a crafted tensor payload declares a shape whose computed byte size exceeds the 32-bit signed integer range, causing the size to wrap and allowing an undersized buffer to pass validation. This leads to out-of-bounds reads during tensor operations. Exploitation could allow a remote, unauthenticated attacker to access adjacent process memory or cause a denial of service. A fix has been released in DJL version 0.37.0. Users are advised to upgrade to this version or later. No workaround other than upgrading is available, but limiting tensor input to trusted sources can reduce risk until patched.

GPUThor is a new Rowhammer attack technique targeting Nvidia Ampere GPUs with GDDR6 memory, significantly increasing the effectiveness of bit flips in video memory. It exploits a hardware behavior where repeated memory access can corrupt data in neighboring cells, bypassing standard defenses like Target Row Refresh (TRR). The attack can cause double and triple-bit errors, which are not fully corrected by ECC memory, leading to denial of service conditions such as GPU reboots and hardware faults. While arbitrary code execution has not been demonstrated, the attack shows a theoretical potential to compromise industrial GPUs and cloud infrastructure using such accelerators.

CVE-2026-85786 is a memory-amplification denial of service vulnerability in the Amazon ion-java library. It arises from an incomplete fix for a previous vulnerability (CVE-2026-75936) related to GZIP auto-decompression. The issue allows denial of service via highly compressed data expansion. Versions of ion-java prior to 1.12.1 are affected. The vulnerability has been addressed in ion-java version 1.12.1, and no workarounds are available.

An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion data that exhausts the native call stack and crashes the application using the library, resulting in a denial of service.

GPUThor is a newly disclosed Rowhammer attack targeting NVIDIA Ampere-class GPUs with GDDR6 memory, including RTX A4000, A4500, A5000, and A6000. It bypasses NVIDIA's ECC protections by exploiting undocumented GPU behaviors and a non-uniform hammering pattern to induce high bit-flip rates. This enables denial-of-service conditions and root-level privilege escalation by corrupting GPU page tables. The attack was demonstrated to cause GPU resets and eventual hardware marking for replacement. NVIDIA recommends enabling SYS-ECC and IOMMU/DMA isolation, monitoring error telemetry, and restricting untrusted workloads. Complete protection likely requires future hardware-level defenses and stronger multi-bit ECC. No bit flips were observed on tested GDDR6X or HBM2e GPUs using the same attack patterns.