https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T02:46:35.963789+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0901 certfr-2026-avi-0901 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-03T02:46:36.179494+00:00 certfr-2026-avi-0901 https://cve.radiocsirt.org/vuln/euvd-2026-293185 EUVD-2026-293185 2026-10-03T02:46:36.179537+00:00 EUVD-2026-293185 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39865 fkie_cve-2026-39865 2026-10-03T02:46:36.179551+00:00

Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability exists in the Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.

 https://cve.radiocsirt.org/vuln/ghsa-qj83-cq47-w5f8 GHSA-qj83-cq47-w5f8 — Axios HTTP/2 Session Cleanup State Corruption Vulnerability 2026-10-03T02:46:36.179583+00:00

Affected: npm: axios

### Summary

Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. This denial-of-service vulnerability affects axios versions prior to 1.13.2 when HTTP/2 is enabled.

### Details

The vulnerability exists in the `Http2Sessions.getSession()` method in `lib/adapters/http.js`. The session cleanup logic contains a control flow error when removing sessions from the sessions array.

**Vulnerable Code:** ```javascript while (i--) { if (entries[i][0] === session) { entries.splice(i, 1); if (len === 1) { delete this.sessions[authority]; return; } } } ```

**Root Cause:** After calling `entries.splice(i, 1)` to remove a session, the original code only returned early if `len === 1`. For arrays with multiple entries, the iteration continued after modifying the array, causing undefined behavior and potential crashes when accessing shifted array indices.

**Fixed Code:** ```javascript while (i--) { if (entries[i][0] === session) { if (len === 1) { delete this.sessions[authority]; } else { entries.splice(i, 1); } return; } } ```

The fix restructures the control flow to immediately return after removing a session, regardless of whether the array is being emptied or just having one element removed. This prevents continued iteration over a modified array and eliminates the state corruption vulnerability.

**Affected Componen…

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-39865 UBUNTU-CVE-2026-39865 2026-10-03T02:46:36.179636+00:00

Affected: Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios

Axios is a promise based HTTP client for the browser and Node.js. Starting in version 1.13.0 and prior to 1.13.2, Axios HTTP/2 session cleanup logic contains a state corruption bug that allows a malicious server to crash the client process through concurrent session closures. The vulnerability exists in the Http2Sessions.getSession() method in lib/adapters/http.js. The session cleanup logic contains a control flow error when removing sessions from the sessions array. This vulnerability is fixed in 1.13.2.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1127 WID-SEC-W-2026-1127 — IBM App Connect Enterprise Certified Container (axios): Schwachstelle ermöglicht Denial of Service 2026-10-03T02:46:36.179665+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise Certified Container ausnutzen, um einen Denial of Service Angriff durchzuführen.