Blog

Research articles and blog posts from SecDim

29/10/2026

OpenTelemetry Python: Quadratic tracestate Parsing Lets One Request Stall a Server

SecDim Security Research reported CVE-2026-114603, a ReDoS vulnerability in the OpenTelemetry Python API, on 2026-10-03 and the vulnerability was…

22/10/2026

DoS in toml Parser: Quadratic Parsing Lets One Document Stall a Node.js Process

SecDim Security Research reported CVE-2026-114143 and CVE-2026-114141, two DoS vulnerabilities in the toml parser for Node.js on 2026-09-11 and the...

29/09/2026

CVE-2026-102274: Malformed RSA JWK Aborts PyJWT JWK Set Parsing

SecDim Security Research reported CVE-2026-102274 to the PyJWT maintainer on 2026-09-05, and the vulnerability was subsequently fixed in PyJWT…

26/08/2026

Has AI Killed Secure Code Training?

We adopted AI coding tools, our developers ship faster, and the AI already knows the OWASP Top 10. Why are...

22/07/2026

The Missing XXE Controls in JavaScript XML Parsers

At the start of this project, I expected an XML parser to take a file or a raw XML stream,...

10/06/2026

Why you should not use JavaScript sandbox

The maintainers of vm2 have been honest about the limitations of vm2. They have been explicit that new bypasses are...

19/05/2026

React2Shell (CVE-2025-55182): Exploitation Flow and Secure Coding Lessons

We already discussed the impact of React2Shell in our previous blog post and also created an Incident Response challenge that...

01/04/2026

Two Incomplete Fixes for a Path Traversal Vulnerability in ONNX (CVE-2026-27489)

Some vulnerabilities are patched once and forgotten. Others keep coming back because each fix only addresses the symptom rather than...

24/03/2026

Dangerous by Default: What OpenClaw CVE Record Tells Us About Agentic AI

Your AI assistant just received a WhatsApp message. It ran a shell command. Then it wrote new code and executed...