Ravindu Lakmina Munaweera - Security Research

Ravindu Lakmina Munaweera - Security Research https://ravindulakmina.pages.dev/ Recent content on Ravindu Lakmina Munaweera - Security Research Hugo en-us Tue, 29 Sep 2026 00:00:00 +0000 One UDP Packet to Freeze an iperf3 Server: CVE-2026-102253 https://ravindulakmina.pages.dev/advisories/iperf3-udp-infinite-loop-dos/ Tue, 29 Sep 2026 00:00:00 +0000 https://ravindulakmina.pages.dev/advisories/iperf3-udp-infinite-loop-dos/ A single crafted parameter message and one 16-byte UDP datagram pin an iperf3 server’s receive thread at 100% CPU forever — unauthenticated, no valid test session. Fixed in iperf3 3.22. From a Stray Apostrophe to Root: Escalating a Standard HestiaCP Account to Full Server Compromise https://ravindulakmina.pages.dev/advisories/hestiacp-apostrophe-to-root/ Tue, 15 Sep 2026 00:00:00 +0000 https://ravindulakmina.pages.dev/advisories/hestiacp-apostrophe-to-root/ A single quote in a directory name lets any standard HestiaCP user account escalate to root. Reported, confirmed, and fixed in HestiaCP 1.10.5. GHSA-r9q4-pmcm-5qqf, CVSS 9.9.