Prasanna Dabi prasanna8585

Hi there, I'm Prasanna Dabi 👋

Specializing in cloud infrastructure hardening and advanced threat detection.

Project: Go Core Image Packages (golang.org/x/image/tiff)
Vulnerability: Unbounded Memory Allocation / Resource Exhaustion - CVSS 7.5
Official Advisory: GO-2026-5062 | GHSA-pwfv-328h-75x9
Impact: Identified a resource validation flaw where processing maliciously crafted tiled TIFF images forces immediate Out of Memory (OOM) errors and Denial of Service (DoS).

Project: Google go-attestation Library
Vulnerability: Improper Input Validation / TPM Hash Injection - CVSS 8.9
Official Advisory: GHSA-9r4w-jg96-92mv
Impact: Discovered a critical logic flaw in parseEfiSignatureList() where a crafted TPM event log can inject arbitrary SHA256 hashes into a verifier's trusted database, causing a compromised boot state to be falsely accepted.

Project: Percona Monitoring and Management (PMM)
Vulnerability: Authenticated Remote Code Execution (RCE) - CVSS 9.9
Official Advisory: GHSA-hm6f-x2ww-p497
Impact: Identified a critical flaw allowing full host compromise via reverse shell.

Project: Go Extended Cryptography Library (golang/go / x/crypto)
Vulnerability: Improper Input Sanitization / ANSI Escape Sequence Injection
Official Advisory: Issue #80302
Impact: Discovered a vulnerability in the ssh.BannerDisplayStderr() helper function where pre-authentication SSH banners were streamed directly to os.Stderr without data sanitization. A malicious or compromised server could inject arbitrary ANSI escape codes to execute terminal spoofing, manipulate clipboards, or potentially exploit underlying terminal emulator vulnerabilities on the client side.

Project: Google gVisor Container Sandbox (google/gvisor)
Vulnerability: Mount Namespace Security / Container Isolation Bypass
Official Advisory: Issue #13481 | Pull Request #13482
Impact: Discovered a sandbox isolation flaw where open_tree(OPEN_TREE_CLONE) incorrectly succeeded on MNT_DETACH unmounted paths (which strictly returns EINVAL on native Linux). This allowed a user with container root privileges to clone and re-attach an intentionally isolated filesystem via move_mount(2), completely breaking container containment boundaries.

Project: Trezor Blockbook Service
Vulnerability: Unauthenticated Resource Exhaustion (DoS)
Official Advisory: Trezor Security
Impact: Identified an amplification flaw where uncapped change indexes in xpub descriptors forced excessive database lookups and address derivations, filling a global in-memory cache and forcing a complete Out-of-Memory (OOM) server crash.

Project: Trezor Blockbook Service
Vulnerability: Denial of Service (DoS) via Unbounded Timestamp Array
Official Advisory: Trezor Security
Impact: Found a flaw in the historical price API allowing unauthenticated remote attackers to pass massive, unbounded timestamp arrays to trigger rapid server memory exhaustion.

Project: PowerDNS dnsdist
Vulnerability: Logic Flaw / Denial of Service (DoS) Mitigation Bypass
Official Advisory: Pull Request #17287
Impact: Discovered a critical logic error in bpf-filter.cc where range-based subnet evaluation queries incorrectly triggered a runtime error, completely breaking active eBPF-based blocking mechanisms and leaving the DNS infrastructure exposed during traffic spikes.

Project: PowerDNS dnsdist
Vulnerability: Authorization Bypass / Improper Access Control
Official Advisory: Pull Request #17291
Impact: Identified a security boundary issue where restricted "Read-Only" API tokens could bypass endpoint separation rules to execute unintended state-changing memory actions (such as purging the global packet cache and exploiting CORS misconfigurations), breaking the isolation between read and write access keys.

"Securing the cloud, one exploit at a time."