https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T10:34:39.038333+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0698 certfr-2026-avi-0698 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-04T10:34:39.137140+00:00 certfr-2026-avi-0698 https://cve.radiocsirt.org/vuln/cleanstart-2026-be61221 Withdrawn: CLEANSTART-2026-BE61221 — Security fixes for CVE-2025-62718, CVE-2025-69873, CVE-2026-29045, CVE-2026-29085, CVE-2026-29086, CVE-2026-29087, CVE-… 2026-10-04T10:34:39.137204+00:00

Withdrawn by the publisher.

Affected: CleanStart: opensearch-dashboards-fips

Multiple security vulnerabilities affect the opensearch-dashboards-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-292960 EUVD-2026-292960 2026-10-04T10:34:39.137253+00:00 EUVD-2026-292960 https://cve.radiocsirt.org/vuln/fkie_cve-2026-42036 fkie_cve-2026-42036 2026-10-04T10:34:39.137268+00:00

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.

 https://cve.radiocsirt.org/vuln/ghsa-vf2m-468p-8v99 GHSA-vf2m-468p-8v99 — Axios: HTTP adapter streamed responses bypass maxContentLength 2026-10-04T10:34:39.137292+00:00

Affected: npm: axios

### Summary

When responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption.

### Details In lib/adapters/http.js: - 786-789: for responseType === 'stream', Axios immediately settles with the stream. - 797-810: maxContentLength enforcement exists only in the non-stream buffering branch.

So callers may set maxContentLength and still receive/read arbitrarily large streamed responses.

### PoC

Environment: - Axios main at commit f7a4ee2 - Node v24.2.0

Steps:

1. Start an HTTP server that returns a 2 MiB response body. 2. Call Axios with: - adapter: 'http' - responseType: 'stream' - maxContentLength: 1024 3. Read the returned stream fully.

Observed: - Success; full 2097152 bytes readable.

Control check: - Same endpoint with responseType: 'text' and same maxContentLength: rejected with maxContentLength size of 1024 exceeded.

### Impact Type: DoS / unbounded response processing. Impacted: Node.js applications relying on maxContentLength as a safety boundary while using streamed Axios responses.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-42036 UBUNTU-CVE-2026-42036 2026-10-04T10:34:39.137329+00:00

Affected: Ubuntu:Pro:20.04:LTS: node-axios, Ubuntu:Pro:22.04:LTS: node-axios, Ubuntu:Pro:24.04:LTS: node-axios, Ubuntu:25.10: node-axios, Ubuntu:Pro:26.04:LTS: node-axios

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when responseType: 'stream' is used, Axios returns the response stream without enforcing maxContentLength. This bypasses configured response-size limits and allows unbounded downstream consumption. This vulnerability is fixed in 1.15.1 and 0.31.1.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1450 WID-SEC-W-2026-1450 — IBM App Connect Enterprise (Axios): Mehrere Schwachstellen 2026-10-04T10:34:39.137356+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, wodurch weitere Angriffe möglich werden.