https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 17:12:12 +0000 https://db.gcve.eu/vuln/cve-2026-6733 <p><strong>Affected:</strong> undici</p> <p>Impact: Undici&#39;s HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.</p> <p>This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.</p> <p>Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.</p> <p>Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.</p> <p><strong>Affected:</strong> undici</p> <p>Impact: Undici&#39;s HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.</p> <p>This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.</p> <p>Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0.</p> <p>Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.</p> https://db.gcve.eu/vuln/cve-2026-6733