https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:12:24 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/cleanstart-2026-ti91814 <p><strong>Affected:</strong> CleanStart: langfuse</p> <p>Security vulnerability affects the langfuse package. undici&#39;s retry handler can leave an already-exposed response body pending forever.</p> <p><strong>Affected:</strong> CleanStart: langfuse</p> <p>Security vulnerability affects the langfuse package. undici&#39;s retry handler can leave an already-exposed response body pending forever.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ti91814 https://cve.radiocsirt.org/vuln/euvd-2026-363999 EUVD-2026-363999 https://cve.radiocsirt.org/vuln/euvd-2026-363999 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18149 <p>undici&#39;s retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed. As a result calls that read that body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body. An attacker-controlled server can trigger this with two short responses without keeping a connection open, and repeated requests accumulate pending promises and streams that can exhaust application concurrency or memory. This affects undici versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.</p> <p>undici&#39;s retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed. As a result calls that read that body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body. An attacker-controlled server can trigger this with two short responses without keeping a connection open, and repeated requests accumulate pending promises and streams that can exhaust application concurrency or memory. This affects undici versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18149 https://cve.radiocsirt.org/vuln/ghsa-pmjh-fq2x-6v4x <p><strong>Affected:</strong> npm: undici</p> <p>### Impact</p> <p>undici&#39;s `RetryHandler` can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original `response.body` held by the application is never settled, so reads such as `response.body.text()` hang and `bodyTimeout` does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service.</p> <p>### Patches</p> <p>Patched in undici v7.29.1 and v8.10.2.</p> <p>### Workarounds</p> <p>Impose an independent request deadline and destroy the response body when it expires. `bodyTimeout` alone does not prevent this.</p> <p><strong>Affected:</strong> npm: undici</p> <p>### Impact</p> <p>undici&#39;s `RetryHandler` can leave a response body pending indefinitely. When a retried request receives a non-retryable response after a truncated one, the original `response.body` held by the application is never settled, so reads such as `response.body.text()` hang and `bodyTimeout` does not fire. A malicious server can repeat this to accumulate pending promises and streams, leading to denial of service.</p> <p>### Patches</p> <p>Patched in undici v7.29.1 and v8.10.2.</p> <p>### Workarounds</p> <p>Impose an independent request deadline and destroy the response body when it expires. `bodyTimeout` alone does not prevent this.</p> https://cve.radiocsirt.org/vuln/ghsa-pmjh-fq2x-6v4x https://cve.radiocsirt.org/vuln/msrc_cve-2026-18149 msrc_CVE-2026-18149 https://cve.radiocsirt.org/vuln/msrc_cve-2026-18149 https://cve.radiocsirt.org/vuln/rhsa-2026:54389 <p>brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function undici: undici: Denial of Service due to orphaned response body in retry handler brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation undici: undici: Denial of Service via unbounded decompression of compressed responses undici: undici: Cross-user cookie disclosure via Set-Cookie caching undici: Undici: Response truncation and connection termination undici: undici: Integrity failure due to caching of unsafe HTTP method responses undici: undici: Denial of Service via WebSocketStream unclean close undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation</p> <p>brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function undici: undici: Denial of Service due to orphaned response body in retry handler brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation undici: undici: Denial of Service via unbounded decompression of compressed responses undici: undici: Cross-user cookie disclosure via Set-Cookie caching undici: Undici: Response truncation and connection termination undici: undici: Integrity failure due to caching of unsafe HTTP method responses undici: undici: Denial of Service via WebSocketStream unclean close undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation</p> https://cve.radiocsirt.org/vuln/rhsa-2026:54389 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-18149 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>undici&#39;s retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed. As a result calls that read that body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body. An attacker-controlled server can trigger this with two short responses without keeping a connection open, and repeated requests accumulate pending promises and streams that can exhaust application concurrency or memory. This affects undici versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>undici&#39;s retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares a Content-Length, sends only part of the body, and closes the connection, the retry handler retries the request. If the retry returns a non-retryable status such as 400, the handler forwards that new response downstream and replaces its internal response stream, but the original response body that the application still holds is never ended or destroyed. As a result calls that read that body never settle, and the configured body timeout does not fire because its timer is tied to the connection parser rather than the orphaned body. An attacker-controlled server can trigger this with two short responses without keeping a connection open, and repeated requests accumulate pending promises and streams that can exhaust application concurrency or memory. This affects undici versions from 7.11.0 up to 7.29.1 and from 8.0.0 up to 8.10.2. Users should upgrade to undici 7.29.1 or 8.10.2.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-18149 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3596 <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3596