https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 12:36:01 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1233 https://cve.radiocsirt.org/vuln/cleanstart-2026-ec11110 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-superset</p> <p>Multiple security vulnerabilities affect the apache-superset package. undici&#39;s retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response&#39;s status and headers. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: apache-superset</p> <p>Multiple security vulnerabilities affect the apache-superset package. undici&#39;s retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response&#39;s status and headers. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ec11110 https://cve.radiocsirt.org/vuln/euvd-2026-364000 EUVD-2026-364000 https://cve.radiocsirt.org/vuln/euvd-2026-364000 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18540 <p>undici&#39;s retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response&#39;s status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.</p> <p>undici&#39;s retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response&#39;s status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18540 https://cve.radiocsirt.org/vuln/ghsa-r53p-7pc4-xj5r <p><strong>Affected:</strong> npm: undici</p> <p>### Impact</p> <p>Undici&#39;s `interceptors.retry()` can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response&#39;s status and headers. When that response carried a `Content-Length`, the application can receive a longer body. Applications that forward Undici&#39;s status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded `Content-Length`, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).</p> <p>For example, a `404 Not Found` with `Content-Length: 2` that sends one byte then closes can be resumed with an open-ended `Range` request, and the resumed `206 Partial Content` bytes are appended, so the application receives more than two body bytes while still seeing `Content-Length: 2`. The bug requires `interceptors.retry()` enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate `Content-Length`.</p> <p>### Patches</p> <p>Patched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later.</p> <p>### Workarounds</p> <p>- Disable `interceptors.retry()` for untrusted upstreams, or set `maxRetries: 0`. - Remove or recalculate `Content-Length` before forwarding a response body assembled by Undici.</p> <p><strong>Affected:</strong> npm: undici</p> <p>### Impact</p> <p>Undici&#39;s `interceptors.retry()` can resume a request after a partial response and append the resumed bytes to an already partially delivered body, while the application still receives the original response&#39;s status and headers. When that response carried a `Content-Length`, the application can receive a longer body. Applications that forward Undici&#39;s status, headers, and body downstream without recalculating framing, for example proxy or gateway applications, may emit a response whose body exceeds the forwarded `Content-Length`, and the excess bytes can be read as the start of a subsequent HTTP response (downstream response splitting or desynchronization).</p> <p>For example, a `404 Not Found` with `Content-Length: 2` that sends one byte then closes can be resumed with an open-ended `Range` request, and the resumed `206 Partial Content` bytes are appended, so the application receives more than two body bytes while still seeing `Content-Length: 2`. The bug requires `interceptors.retry()` enabled, an attacker-controlled or faulty upstream, and a downstream forwarder that does not recalculate `Content-Length`.</p> <p>### Patches</p> <p>Patched in undici v6.28.1, v7.29.1, and v8.10.2. Upgrade to one of these or later.</p> <p>### Workarounds</p> <p>- Disable `interceptors.retry()` for untrusted upstreams, or set `maxRetries: 0`. - Remove or recalculate `Content-Length` before forwarding a response body assembled by Undici.</p> https://cve.radiocsirt.org/vuln/ghsa-r53p-7pc4-xj5r https://cve.radiocsirt.org/vuln/msrc_cve-2026-18540 msrc_CVE-2026-18540 https://cve.radiocsirt.org/vuln/msrc_cve-2026-18540 https://cve.radiocsirt.org/vuln/rhsa-2026:66008 <p>grafana: Grafana: Session takeover via Auth Proxy cache key collision undici: undici: Denial of Service due to orphaned response body in retry handler undici: undici: HTTP response splitting via retry interceptor undici: undici: Denial of Service via unrequested WebSocket subprotocol grafana: Grafana: Unauthorized public dashboard deletion across organizations undici: undici: Denial of Service via unbounded decompression of compressed responses undici: undici: Cross-user cookie disclosure via Set-Cookie caching undici: Undici: Response truncation and connection termination undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options undici: undici: Integrity failure due to caching of unsafe HTTP method responses undici: undici: Denial of Service via WebSocketStream unclean close</p> <p>grafana: Grafana: Session takeover via Auth Proxy cache key collision undici: undici: Denial of Service due to orphaned response body in retry handler undici: undici: HTTP response splitting via retry interceptor undici: undici: Denial of Service via unrequested WebSocket subprotocol grafana: Grafana: Unauthorized public dashboard deletion across organizations undici: undici: Denial of Service via unbounded decompression of compressed responses undici: undici: Cross-user cookie disclosure via Set-Cookie caching undici: Undici: Response truncation and connection termination undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options undici: undici: Integrity failure due to caching of unsafe HTTP method responses undici: undici: Denial of Service via WebSocketStream unclean close</p> https://cve.radiocsirt.org/vuln/rhsa-2026:66008 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-18540 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>undici&#39;s retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response&#39;s status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>undici&#39;s retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response&#39;s status and headers. This happens when an upstream server delivers part of a body without a trustworthy resume checkpoint, for example a non-success response whose headers were already sent or a partial-content response with an unusable content range, then closes the connection and answers the resumed range request with more bytes. As a result the response body can be longer than the Content-Length that the application observes. An application that relays such a response to a downstream HTTP/1.1 peer without normalizing the framing can emit a body that exceeds the forwarded Content-Length, and the excess bytes can be interpreted as the start of a following response, which enables downstream response splitting or desynchronization. Exploitation requires an attacker-controlled upstream server and an application that forwards the response through a framing-sensitive path. This affects undici versions before 6.28.1, from 7.0.0 up to 7.29.1, and from 8.0.0 up to 8.10.2. Users should upgrade to undici 6.28.1, 7.29.1, or 8.10.2.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-18540 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3596 <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3596