https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:18:57 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/cleanstart-2026-bg21634 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: langfuse-worker</p> <p>Package langfuse-worker version 3.216.0-r1 fixes 29 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: langfuse-worker</p> <p>Package langfuse-worker version 3.216.0-r1 fixes 29 vulnerabilities: ghsa-frvp-7c67-39w9, ghsa-p63j-vcc4-9vmv, ghsa-55q2-fjhq-7xh7, ghsa-c2j3-45gr-mqc4, CVE-2026-69192...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bg21634 https://cve.radiocsirt.org/vuln/euvd-2026-342443 EUVD-2026-342443 https://cve.radiocsirt.org/vuln/euvd-2026-342443 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13697 <p>undici&#39;s cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer&#39;s error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.</p> <p>undici&#39;s cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer&#39;s error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-13697 https://cve.radiocsirt.org/vuln/ghsa-4cwx-7wf7-3272 <p><strong>Affected:</strong> npm: undici</p> <p>### Summary</p> <p>Two issues in undici&#39;s cache interceptor, both fixed by the same patch on `lib/util/cache.js`:</p> <p>1. **Shared-cache disclosure:** Responses with malformed qualified `Cache-Control: private` directives such as `private=&#34;&#34;` or `private=&#34;,&#34;` can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key. 2. **Parse-time crash:** Mixed unqualified-and-qualified `private` directives in the same header (such as `public, max-age=60, private, private=&#34;hdr&#34;`) cause an uncaught `TypeError` in the cache-control parser, terminating the request.</p> <p>### Impact</p> <p>#### Shared-cache disclosure</p> <p>Applications using `interceptors.cache()` in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including `Set-Cookie`.</p> <p>Required conditions:</p> <p>- the cache interceptor is enabled in shared mode, including the default configuration; - an upstream returns a malformed directive such as `Cache-Control: public, max-age=300, private=&#34;&#34;`; - another request later matches the same cache key, without a separating `Vary` header.</p> <p>#### Parse-time crash</p> <p>Applications using `interceptors.cache()` against an upstream that returns a `Cache-Control` header combining unqualified `private` with qualified `private=&#34;...&#34;` see an uncaught `TypeError: output.private.concat is not a function` during response handling. The request rejects; depending on the consumer&#39;s e…</p> <p><strong>Affected:</strong> npm: undici</p> <p>### Summary</p> <p>Two issues in undici&#39;s cache interceptor, both fixed by the same patch on `lib/util/cache.js`:</p> <p>1. **Shared-cache disclosure:** Responses with malformed qualified `Cache-Control: private` directives such as `private=&#34;&#34;` or `private=&#34;,&#34;` can be incorrectly stored in the default shared cache, then served to a later caller with the same cache key. 2. **Parse-time crash:** Mixed unqualified-and-qualified `private` directives in the same header (such as `public, max-age=60, private, private=&#34;hdr&#34;`) cause an uncaught `TypeError` in the cache-control parser, terminating the request.</p> <p>### Impact</p> <p>#### Shared-cache disclosure</p> <p>Applications using `interceptors.cache()` in shared mode may cache a user-specific response and serve it to a later caller with the same cache key. This can disclose private response bodies and headers, including `Set-Cookie`.</p> <p>Required conditions:</p> <p>- the cache interceptor is enabled in shared mode, including the default configuration; - an upstream returns a malformed directive such as `Cache-Control: public, max-age=300, private=&#34;&#34;`; - another request later matches the same cache key, without a separating `Vary` header.</p> <p>#### Parse-time crash</p> <p>Applications using `interceptors.cache()` against an upstream that returns a `Cache-Control` header combining unqualified `private` with qualified `private=&#34;...&#34;` see an uncaught `TypeError: output.private.concat is not a function` during response handling. The request rejects; depending on the consumer&#39;s e…</p> https://cve.radiocsirt.org/vuln/ghsa-4cwx-7wf7-3272 https://cve.radiocsirt.org/vuln/rhsa-2026:48273 <p>undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing undici: undici: HTTP header injection via unvalidated blob-like body type property undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length undici: Undici: Cookie attribute injection allows bypassing security protections nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw nodejs: Information disclosure due to improper permission enforcement nodejs: HTTPS Agent TLS session reuse skips hostname verification nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw</p> <p>undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing undici: undici: HTTP header injection via unvalidated blob-like body type property undici: undici: Response desynchronization via retry interceptor with mismatched Content-Length undici: Undici: Cookie attribute injection allows bypassing security protections nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw nodejs: Information disclosure due to improper permission enforcement nodejs: HTTPS Agent TLS session reuse skips hostname verification nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw</p> https://cve.radiocsirt.org/vuln/rhsa-2026:48273 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-13697 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>undici&#39;s cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer&#39;s error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>undici&#39;s cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer&#39;s error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-13697 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3621 <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, um Daten zu manipulieren und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3621