https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 10:11:40 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-bs54075 <p><strong>Affected:</strong> CleanStart: npm</p> <p>ghsa-35p6-xmwp-9g52 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: npm</p> <p>ghsa-35p6-xmwp-9g52 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bs54075 https://cve.radiocsirt.org/vuln/cve-2026-6733 <p><strong>Affected:</strong> undici</p> <p>Impact: Undici&#39;s HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.</p> <p>This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.</p> <p>Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.</p> <p>Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.</p> <p><strong>Affected:</strong> undici</p> <p>Impact: Undici&#39;s HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.</p> <p>This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.</p> <p>Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.</p> <p>Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.</p> https://cve.radiocsirt.org/vuln/cve-2026-6733