yo everyone 👋

Big day for me — I just got my first 2 CVEs, both rated High severity (CVSS 8.7) 🎉

And here’s the crazy part: I found both in just 8 days. Not months. Just 8 days of sitting down and actually reading the code. If I can do it, trust me — so can you 💙

Proud to put Tamil Nadu 🇮🇳 on the CVE map 🔥

In simple words, here’s what I found 👇

🐛 CVE-2026-109563 — a bug in N3.js (a popular tool that reads data files)

I found that if you feed it a specially crafted input, the tool gets stuck doing way too much work and freezes the whole app. Basically, one bad input can take the entire thing down.

CVSS 8.7 (High) · already fixed in v2.11.1 ✅

🔗 https://www.cve.org/CVERecord?id=CVE-2026-109563

🐛 CVE-2020-37280 — a bug in cbor-sync (a tool that decodes data)

This one blindly trusts whatever “size” the incoming data claims — without checking it. So a tiny fake file can say “I’m huge”, and the tool tries to process billions of items until it eats up all the CPU and memory and crashes.

CVSS 8.7 (High) · found together with 2 friends 🤝

🔗 https://www.cve.org/CVERecord?id=CVE-2020-37280

What I learned: tools that read or decode data (parsers) are full of bugs like this. You don’t need crazy skills — just patience and reading the actual code 🪙

Honestly, “finding a CVE” sounds scary from the outside. But once you start, it’s way more doable than you think.

💙 If you want to start CVE hunting or you’re stuck somewhere — just message me. I’ll help however I can. No gatekeeping here 🤙

🔗 Let’s connect:

LinkedIn: https://www.linkedin.com/in/mohammed-arfath-a-426758289

GitHub: https://github.com/frxarfath404

Discord: frxarfath

Much love from Tamil Nadu 💙🚀

N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service.