https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T20:16:19.113556+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-05692 bdu:2026-05692 2026-10-03T20:16:19.211138+00:00 bdu:2026-05692 https://cve.radiocsirt.org/vuln/certfr-2025-avi-1051 certfr-2025-avi-1051 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T20:16:19.211176+00:00 certfr-2025-avi-1051 https://cve.radiocsirt.org/vuln/euvd-2026-267595 EUVD-2026-267595 2026-10-03T20:16:19.211194+00:00 EUVD-2026-267595 https://cve.radiocsirt.org/vuln/fkie_cve-2025-47279 fkie_cve-2025-47279 2026-10-03T20:16:19.211206+00:00

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.

 https://cve.radiocsirt.org/vuln/ghsa-cxrh-j4jr-qwg3 GHSA-cxrh-j4jr-qwg3 — undici Denial of Service attack via bad certificate data 2026-10-03T20:16:19.211254+00:00

Affected: npm: undici

### Impact

Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.

### Patches

This has been patched in https://github.com/nodejs/undici/pull/4088.

### Workarounds

If a webhook fails, avoid keep calling it repeatedly.

### References

Reported as: https://github.com/nodejs/undici/issues/3895

 https://cve.radiocsirt.org/vuln/msrc_cve-2025-47279 msrc_CVE-2025-47279 — undici Denial of Service attack via bad certificate data 2026-10-03T20:16:19.211287+00:00 msrc_CVE-2025-47279 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-47279 UBUNTU-CVE-2025-47279 2026-10-03T20:16:19.211304+00:00

Affected: Ubuntu:24.04:LTS: node-undici, Ubuntu:25.10: node-undici, Ubuntu:26.04:LTS: node-undici

Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak. This has been patched in versions 5.29.0, 6.21.2, and 7.5.0. As a workaound, avoid calling a webhook repeatedly if the webhook fails.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-1101 WID-SEC-W-2025-1101 — IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of Service 2026-10-03T20:16:19.211328+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um einen Denial of Service Angriff durchzuführen.