Vulnerability-Lookup

RHSA-2026:38009

Vulnerability from csaf_redhat - Published: 2026-07-10 17:41 - Updated: 2026-11-07 05:57

Summary

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Severity

Important

Notes

Topic: An update for Red Hat Hardened Images RPMs is now available.

Details: This update includes the following RPMs: nodejs26: * nodejs26-26.5.0-1.3.hum1 (aarch64, x86_64) * nodejs26-bin-26.5.0-1.3.hum1 (noarch) * nodejs26-devel-26.5.0-1.3.hum1 (aarch64, x86_64) * nodejs26-docs-26.5.0-1.3.hum1 (noarch) * nodejs26-full-i18n-26.5.0-1.3.hum1 (aarch64, x86_64) * nodejs26-libs-26.5.0-1.3.hum1 (aarch64, x86_64) * nodejs26-npm-11.17.0-1.26.5.0.1.3.hum1 (noarch) * nodejs26-npm-bin-26.5.0-1.3.hum1 (noarch) * v8-14.6-devel-14.6.202.34-1.26.5.0.1.3.hum1 (aarch64, x86_64) * nodejs26-26.5.0-1.3.hum1.src (src)

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-6733

A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in Undici's HTTP/1.1 client, specifically related to response queue poisoning on reused keep-alive sockets. This allows the attacker to inject an unsolicited HTTP/1.1 response onto an idle socket. Consequently, when the client dispatches a new request on that socket, it may associate the injected response with the new request, leading to responses being delivered to unintended recipients or requests. This could result in a low impact on data integrity.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE-940 - Improper Verification of Source of a Communication Channel

Affected products

Fixed 17 products

Product	Version	Remediation
Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms	—	Vendor Fix fix Workaround
Unresolved product id: Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms	—	Vendor Fix fix Workaround

Known not affected 2 products

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64		—	Workaround
Unresolved product id: Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64		—	Workaround

Threats

Impact Low

CVE-2026-9679

A flaw was found in undici. The cookie parser in the `parseSetCookie` function incorrectly decodes cookie values, which is contrary to standard specifications. This vulnerability allows an attacker-controlled upstream to inject arbitrary HTTP response headers, such as `Set-Cookie`, `Location`, or `Cache-Control`. The primary consequence is HTTP response header injection, which can lead to session fixation, open redirect, or cache poisoning.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-93 - Improper Neutralization of CRLF Sequences

Affected products

Fixed 17 products, the same list as for CVE-2026-6733

Known not affected 2 products, the same list as for CVE-2026-6733

Threats

Impact Moderate

CVE-2026-12151

A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion, resulting in a denial of service (DoS) for affected applications using the undici WebSocket client or WebSocketStream API.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-770 - Allocation of Resources Without Limits or Throttling

Affected products

Fixed 17 products, the same list as for CVE-2026-6733

Known not affected 2 products, the same list as for CVE-2026-6733

Threats

Impact Important

References

24 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:38009	self
https://images.redhat.com/	external
https://access.redhat.com/security/cve/CVE-2026-9679	external
https://access.redhat.com/security/updates/classi…	external
https://access.redhat.com/security/cve/CVE-2026-6733	external
https://access.redhat.com/security/cve/CVE-2026-12151	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-6733	self
https://bugzilla.redhat.com/show_bug.cgi?id=2490006	external
https://www.cve.org/CVERecord?id=CVE-2026-6733	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6733	external
https://cna.openjsf.org/security-advisories.html	external
https://github.com/nodejs/undici/security/advisor…	external
https://hackerone.com/reports/3582376	external
https://access.redhat.com/security/cve/CVE-2026-9679	self
https://bugzilla.redhat.com/show_bug.cgi?id=2490022	external
https://www.cve.org/CVERecord?id=CVE-2026-9679	external
https://nvd.nist.gov/vuln/detail/CVE-2026-9679	external
https://github.com/nodejs/undici/security/advisor…	external
https://access.redhat.com/security/cve/CVE-2026-12151	self
https://bugzilla.redhat.com/show_bug.cgi?id=2489980	external
https://www.cve.org/CVERecord?id=CVE-2026-12151	external
https://nvd.nist.gov/vuln/detail/CVE-2026-12151	external
https://github.com/nodejs/undici/security/advisor…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for Red Hat Hardened Images RPMs is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This update includes the following RPMs:\n\nnodejs26:\n  * nodejs26-26.5.0-1.3.hum1 (aarch64, x86_64)\n  * nodejs26-bin-26.5.0-1.3.hum1 (noarch)\n  * nodejs26-devel-26.5.0-1.3.hum1 (aarch64, x86_64)\n  * nodejs26-docs-26.5.0-1.3.hum1 (noarch)\n  * nodejs26-full-i18n-26.5.0-1.3.hum1 (aarch64, x86_64)\n  * nodejs26-libs-26.5.0-1.3.hum1 (aarch64, x86_64)\n  * nodejs26-npm-11.17.0-1.26.5.0.1.3.hum1 (noarch)\n  * nodejs26-npm-bin-26.5.0-1.3.hum1 (noarch)\n  * v8-14.6-devel-14.6.202.34-1.26.5.0.1.3.hum1 (aarch64, x86_64)\n  * nodejs26-26.5.0-1.3.hum1.src (src)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:38009",
        "url": "https://access.redhat.com/errata/RHSA-2026:38009"
      },
      {
        "category": "external",
        "summary": "https://images.redhat.com/",
        "url": "https://images.redhat.com/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-9679",
        "url": "https://access.redhat.com/security/cve/CVE-2026-9679"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6733",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6733"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-12151",
        "url": "https://access.redhat.com/security/cve/CVE-2026-12151"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_38009.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2026-11-07T05:57:41+00:00",
      "generator": {
        "date": "2026-11-07T05:57:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:38009",
      "initial_release_date": "2026-07-10T17:41:23+00:00",
      "revision_history": [
        {
          "date": "2026-07-10T17:41:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-07T14:22:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-07T05:57:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Hardened Images",
                "product": {
                  "name": "Red Hat Hardened Images",
                  "product_id": "Red Hat Hardened Images",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:hummingbird:1"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Hardened Images"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.5.0-1.3.hum1@aarch64",
                "product": {
                  "name": "nodejs26-1:26.5.0-1.3.hum1@aarch64",
                  "product_id": "nodejs26-1:26.5.0-1.3.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.5.0-1.3.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
                "product": {
                  "name": "nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
                  "product_id": "nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-devel@26.5.0-1.3.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
                "product": {
                  "name": "nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
                  "product_id": "nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.5.0-1.3.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
                "product": {
                  "name": "nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
                  "product_id": "nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs@26.5.0-1.3.hum1?arch=aarch64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
                "product": {
                  "name": "v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
                  "product_id": "v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.5.0.1.3.hum1?arch=aarch64\u0026epoch=3\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.5.0-1.3.hum1@src",
                "product": {
                  "name": "nodejs26-1:26.5.0-1.3.hum1@src",
                  "product_id": "nodejs26-1:26.5.0-1.3.hum1@src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.5.0-1.3.hum1?arch=src\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-1:26.5.0-1.3.hum1@x86_64",
                "product": {
                  "name": "nodejs26-1:26.5.0-1.3.hum1@x86_64",
                  "product_id": "nodejs26-1:26.5.0-1.3.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26@26.5.0-1.3.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
                "product": {
                  "name": "nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
                  "product_id": "nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-devel@26.5.0-1.3.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
                "product": {
                  "name": "nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
                  "product_id": "nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-full-i18n@26.5.0-1.3.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
                "product": {
                  "name": "nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
                  "product_id": "nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-libs@26.5.0-1.3.hum1?arch=x86_64\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64",
                "product": {
                  "name": "v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64",
                  "product_id": "v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/v8-14.6-devel@14.6.202.34-1.26.5.0.1.3.hum1?arch=x86_64\u0026epoch=3\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-bin@26.5.0-1.3.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-bin@26.5.0-1.3.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-docs@26.5.0-1.3.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-docs@26.5.0-1.3.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm@11.17.0-1.26.5.0.1.3.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm@11.17.0-1.26.5.0.1.3.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                "product": {
                  "name": "nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_id": "nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm-bin@26.5.0-1.3.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                "product": {
                  "name": "nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_id": "nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs26-npm-bin@26.5.0-1.3.hum1?arch=noarch\u0026epoch=1\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.5.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64"
        },
        "product_reference": "nodejs26-1:26.5.0-1.3.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.5.0-1.3.hum1@src as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src"
        },
        "product_reference": "nodejs26-1:26.5.0-1.3.hum1@src",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-1:26.5.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64"
        },
        "product_reference": "nodejs26-1:26.5.0-1.3.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-1:26.5.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64"
        },
        "product_reference": "nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-devel-1:26.5.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64"
        },
        "product_reference": "nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64"
        },
        "product_reference": "nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64"
        },
        "product_reference": "nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-1:26.5.0-1.3.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64"
        },
        "product_reference": "nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-libs-1:26.5.0-1.3.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64"
        },
        "product_reference": "nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms"
        },
        "product_reference": "nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
        },
        "product_reference": "nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64"
        },
        "product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64 as a component of Red Hat Hardened Images",
          "product_id": "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
        },
        "product_reference": "v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64",
        "relates_to_product_reference": "Red Hat Hardened Images"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-6733",
      "cwe": {
        "id": "CWE-940",
        "name": "Improper Verification of Source of a Communication Channel"
      },
      "discovery_date": "2026-06-17T19:02:16.713859+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490006"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in Undici\u0027s HTTP/1.1 client, specifically related to response queue poisoning on reused keep-alive sockets. This allows the attacker to inject an unsolicited HTTP/1.1 response onto an idle socket. Consequently, when the client dispatches a new request on that socket, it may associate the injected response with the new request, leading to responses being delivered to unintended recipients or requests. This could result in a low impact on data integrity.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Low: A flaw in Undici\u0027s HTTP/1.1 client, as used in various Red Hat products, allows an attacker-controlled upstream server to inject unsolicited responses onto reused keep-alive sockets. This can lead to incorrect response delivery, potentially impacting data integrity, but requires a compromised server and active keep-alive connections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6733"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490006",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490006"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6733",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6733"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6733",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6733"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52"
        },
        {
          "category": "external",
          "summary": "https://hackerone.com/reports/3582376",
          "url": "https://hackerone.com/reports/3582376"
        }
      ],
      "release_date": "2026-06-17T17:14:50.991000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-10T17:41:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:38009"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery."
    },
    {
      "cve": "CVE-2026-9679",
      "cwe": {
        "id": "CWE-93",
        "name": "Improper Neutralization of CRLF Sequences"
      },
      "discovery_date": "2026-06-17T19:03:52.323822+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2490022"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. The cookie parser in the `parseSetCookie` function incorrectly decodes cookie values, which is contrary to standard specifications. This vulnerability allows an attacker-controlled upstream to inject arbitrary HTTP response headers, such as `Set-Cookie`, `Location`, or `Cache-Control`. The primary consequence is HTTP response header injection, which can lead to session fixation, open redirect, or cache poisoning.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Moderate: A flaw in the `undici` library\u0027s cookie parser can lead to HTTP response header injection. This occurs when applications, such as proxies or middleware, incorrectly forward percent-decoded cookie values from upstream into downstream response headers. Successful exploitation could result in session fixation, open redirects, or cache poisoning.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-9679"
        },
        {
          "category": "external",
          "summary": "RHBZ#2490022",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490022"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-9679",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-9679"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-9679",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9679"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv"
        }
      ],
      "release_date": "2026-06-17T16:56:18.579000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-10T17:41:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:38009"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undici: undici vulnerable to HTTP header injection via Set-Cookie percent-decoding"
    },
    {
      "cve": "CVE-2026-12151",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-06-17T17:01:45.297604+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2489980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion, resulting in a denial of service (DoS) for affected applications using the undici WebSocket client or WebSocketStream API.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important denial of service flaw in the `undici` WebSocket client allows a remote attacker to cause unbounded memory growth. By sending numerous small or empty WebSocket frames, an unauthenticated attacker can exhaust system memory, leading to a denial of service in Red Hat products that use the affected client.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
          "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
          "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
          "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
          "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
        ],
        "known_not_affected": [
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
          "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-12151"
        },
        {
          "category": "external",
          "summary": "RHBZ#2489980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-12151",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-12151"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12151",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12151"
        },
        {
          "category": "external",
          "summary": "https://cna.openjsf.org/security-advisories.html",
          "url": "https://cna.openjsf.org/security-advisories.html"
        },
        {
          "category": "external",
          "summary": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q",
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q"
        }
      ],
      "release_date": "2026-06-17T16:05:38.785000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-07-10T17:41:23+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:38009"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@src",
            "Red Hat Hardened Images:nodejs26-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-devel-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-docs-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-full-i18n-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@aarch64",
            "Red Hat Hardened Images:nodejs26-libs-1:26.5.0-1.3.hum1@x86_64",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-1:11.17.0-1.26.5.0.1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-aarch64-rpms",
            "Red Hat Hardened Images:nodejs26-npm-bin-1:26.5.0-1.3.hum1@noarch@public-hummingbird-x86_64-rpms",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@aarch64",
            "Red Hat Hardened Images:v8-14.6-devel-3:14.6.202.34-1.26.5.0.1.3.hum1@x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames"
    }
  ]
}

CVE-2026-11525 (GCVE-0-2026-11525)

Vulnerability from cvelistv5 – Published: 2026-06-17 17:31 – Updated: 2026-06-17 17:54

Title

undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching

Summary

Impact: When undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict). Affected applications are those that consume Set-Cookie headers from server responses (for example via undici's fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer's view of a cookie's SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide. This was introduced in undici 5.15.0 when the cookies feature was added. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: After parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of 'Strict', 'Lax', or 'None' (exact, case-insensitive) before forwarding or relying on it.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 17:53 UTC

CWE

CWE-183 - Permissive List of Allowed Inputs

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 0 , < 6.26.0 (semver) Unaffected: 6.26.0 (semver) Affected: 7.0.0 , < 7.28.0 (semver) Unaffected: 7.28.0 (semver) Affected: 8.0.0 , < 8.5.0 (semver) Unaffected: 8.5.0 (semver)

Credits

UlisesGascon KhafraDev mcollina tndud042713

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11525",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T17:53:40.763762Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T17:54:22.022Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.26.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.26.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.28.0",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.28.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "KhafraDev"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "tndud042713"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Impact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie headers from server responses (for example via undici\u0027s fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer\u0027s view of a cookie\u0027s SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.\n\nThis was introduced in undici 5.15.0 when the cookies feature was added.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nAfter parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of \u0027Strict\u0027, \u0027Lax\u0027, or \u0027None\u0027 (exact, case-insensitive) before forwarding or relying on it."
            }
          ],
          "value": "Impact:\nWhen undici parses a Set-Cookie header, it accepts any SameSite attribute value that contains Strict, Lax, or None as a substring, rather than the case-insensitive exact match specified by RFC 6265. Non-spec values are silently mapped to one of the three standard tokens. For example, SameSite=NoneOfYourBusiness is parsed as None (the most permissive setting), and SameSite=StrictLax is parsed as Lax (a downgrade from Strict).\n\nAffected applications are those that consume Set-Cookie headers from server responses (for example via undici\u0027s fetch or proxy code paths) and then forward or rely on the parsed sameSite attribute. A malicious or non-compliant server can coerce the consumer\u0027s view of a cookie\u0027s SameSite policy to a weaker value, silently degrading the SameSite enforcement the cookie is supposed to provide.\n\nThis was introduced in undici 5.15.0 when the cookies feature was added.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nAfter parsing a Set-Cookie header, validate that the resulting sameSite attribute is one of \u0027Strict\u0027, \u0027Lax\u0027, or \u0027None\u0027 (exact, case-insensitive) before forwarding or relying on it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-183",
              "description": "CWE-183: Permissive List of Allowed Inputs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T17:31:03.163Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-g8m3-5g58-fq7m"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to Set-Cookie SameSite attribute downgrade via permissive substring matching",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-11525",
    "datePublished": "2026-06-17T17:31:03.163Z",
    "dateReserved": "2026-06-07T18:49:35.986Z",
    "dateUpdated": "2026-06-17T17:54:22.022Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12151 (GCVE-0-2026-12151)

Vulnerability from cvelistv5 – Published: 2026-06-17 16:05 – Updated: 2026-09-11 12:08

Title

undici WebSocket client vulnerable to denial of service via fragment count bypass

Summary

Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 17:29 UTC

CWE

CWE-400 - Uncontrolled Resource Consumption
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

31 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html
https://access.redhat.com/security/cve/CVE-2026-12151	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2489980	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:48151	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39246	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35842	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35841	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41947	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:39868	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:52399	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35892	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35891	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34342	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66545	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:66488	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36754	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:41929	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38236	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:38009	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:65126	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:60520	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36621	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47728	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:48124	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:36820	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:62260	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56431	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:56366	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:57013	vendor-advisoryx_refsource_REDHAT

Impacted products

107 products

Vendor	Product	Version
undici	undici	Affected: 0 , < 6.26.0 (semver) Unaffected: 6.26.0 (semver) Affected: 7.0.0 , < 7.28.0 (semver) Unaffected: 7.28.0 (semver) Affected: 8.0.0 , < 8.5.0 (semver) Unaffected: 8.5.0 (semver)
Red Hat	Cryostat 4 on RHEL 9	Unaffected: 4.2.0-13 , < * (rpm) cpe:/a:redhat:cryostat:4::el9
Red Hat	Red Hat AMQ Broker 7.13.6	cpe:/a:redhat:amq_broker:7.13
Red Hat	Red Hat AMQ Broker 7.14.1	cpe:/a:redhat:amq_broker:7.14
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:24.18.0-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 1:22.23.1-2.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 1:22.23.1-2.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260630152626.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260703140402.6d880403 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260626074955.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260626075442.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260804140259.rhel9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782840519 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839981 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839193 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782838753 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839279 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782840539 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782841925 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782844225 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839658 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782838476 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839996 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Cluster Observability Operator 1.5.0	Unaffected: 1782839494 , < * (rpm) cpe:/a:redhat:cluster_observability_operator:1.5::el9
Red Hat	Red Hat Developer Hub 1.10	Unaffected: 1783448184 , < * (rpm) cpe:/a:redhat:rhdh:1.10::el9
Red Hat	Red Hat Developer Hub 1.9	Unaffected: 1784210921 , < * (rpm) cpe:/a:redhat:rhdh:1.9::el9
Red Hat	Red Hat Hardened Images	Unaffected: 26.5.0-1.3.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 24.18.0-0.3.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift AI 2.25	Unaffected: 1787801527 , < * (rpm) cpe:/a:redhat:openshift_ai:2.25::el9
Red Hat	Red Hat OpenShift AI 3.4	Unaffected: 1787121387 , < * (rpm) cpe:/a:redhat:openshift_ai:3.4::el9
Red Hat	Red Hat OpenShift Container Platform 4.16	Unaffected: 1783306396 , < * (rpm) cpe:/a:redhat:openshift:4.16::el9
Red Hat	Red Hat OpenShift Container Platform 4.17	Unaffected: 1784744859 , < * (rpm) cpe:/a:redhat:openshift:4.17::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705347 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706101 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705558 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705646 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706138 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705741 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705777 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705802 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786705938 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706577 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706125 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706177 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706188 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706679 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706357 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706612 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706644 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706659 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.18	Unaffected: 1786706880 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.18::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786701839 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786701555 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702052 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702559 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702713 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702264 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702448 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702276 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702440 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702315 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786703071 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702563 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702636 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702623 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786703137 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702716 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702872 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702949 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786702917 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.19	Unaffected: 1786703143 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.19::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627460 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786626399 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628235 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627106 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786629761 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627559 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786687918 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786629478 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628142 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786631508 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628053 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627382 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627430 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786629076 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786627469 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786644072 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786688215 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628340 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628623 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786632256 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786628935 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat Openshift Data Foundation 4.20	Unaffected: 1786629548 , < * (rpm) cpe:/a:redhat:openshift_data_foundation:4.20::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1782498792 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1783007534 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1782989367 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.29	Unaffected: 1785245777 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.29::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.30	Unaffected: 1787760821 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.30::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.30	Unaffected: 1787759145 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.30::el9
Red Hat	Red Hat OpenShift Dev Spaces 3.30	Unaffected: 1787759723 , < * (rpm) cpe:/a:redhat:openshift_devspaces:3.30::el9
Red Hat	Cryostat 4	cpe:/a:redhat:cryostat:4
Red Hat	OpenShift Pipelines	cpe:/a:redhat:openshift_pipelines:1
Red Hat	Red Hat Build of Podman Desktop	cpe:/a:redhat:podman_desktop:1
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat OpenShift AI (RHOAI)	cpe:/a:redhat:openshift_ai
Red Hat	Red Hat OpenShift Container Platform 4	cpe:/a:redhat:openshift:4
Red Hat	Self-service automation portal 2	cpe:/a:redhat:ansible_portal:2

Credits

lpinca Nadav0077 UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12151",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T17:29:57.305732Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T17:30:13.782Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cryostat/cryostat-grafana-dashboard-rhel9",
            "product": "Cryostat 4 on RHEL 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "4.2.0-13",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7.13"
            ],
            "defaultStatus": "unaffected",
            "packageName": "undici",
            "product": "Red Hat AMQ Broker 7.13.6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:amq_broker:7.14"
            ],
            "defaultStatus": "unaffected",
            "packageName": "undici",
            "product": "Red Hat AMQ Broker 7.14.1",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs24",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:24.18.0-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.23.1-2.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs22",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1:22.23.1-2.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260630152626.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260703140402.6d880403",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:24",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260626074955.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260626075442.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs:22",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260804140259.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782840519",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839981",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839193",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/distributed-tracing-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782838753",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839279",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/logging-console-plugin-pf5-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782840539",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/logging-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782841925",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/monitoring-console-plugin-pf5-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782844225",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/monitoring-console-plugin-pf6-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839658",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/monitoring-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782838476",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839996",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:cluster_observability_operator:1.5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-rhel9",
            "product": "Cluster Observability Operator 1.5.0",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782839494",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.10::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-hub-rhel9",
            "product": "Red Hat Developer Hub 1.10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783448184",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhdh:1.9::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhdh/rhdh-hub-rhel9",
            "product": "Red Hat Developer Hub 1.9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784210921",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs26-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "26.5.0-1.3.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs24-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "24.18.0-0.3.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:2.25::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI 2.25",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787801527",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai:3.4::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9",
            "product": "Red Hat OpenShift AI 3.4",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787121387",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.16::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-monitoring-plugin-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.16",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783306396",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift:4.17::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift4/ose-monitoring-plugin-rhel9",
            "product": "Red Hat OpenShift Container Platform 4.17",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784744859",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705347",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706101",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705558",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705646",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706138",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705741",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705777",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705802",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786705938",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706577",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706125",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706177",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706188",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706679",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706357",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706612",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706644",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706659",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.18::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.18",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786706880",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786701839",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786701555",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702052",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702713",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702264",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702448",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702276",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702440",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702315",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786703071",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702563",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702636",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702623",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786703137",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702716",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702872",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702949",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786702917",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.19::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.19",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786703143",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627460",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/cephcsi-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786626399",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-core-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628235",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/mcg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627106",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629761",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-client-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627559",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-metrics-exporter-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786687918",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/ocs-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629478",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cli-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628142",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cloudnative-pg-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786631508",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628053",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-cosi-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627382",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627430",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-csi-addons-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629076",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786627469",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-external-snapshotter-sidecar-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786644072",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-console-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786688215",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-multicluster-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628340",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-must-gather-rhel9",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628623",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odf-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786632256",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/odr-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786628935",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_data_foundation:4.20::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "odf4/rook-ceph-rhel9-operator",
            "product": "Red Hat Openshift Data Foundation 4.20",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786629548",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/dashboard-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782498792",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1783007534",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1782989367",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.29::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/code-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.29",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1785245777",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.30::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/dashboard-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.30",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787760821",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.30::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/openvsx-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.30",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787759145",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:openshift_devspaces:3.30::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "devspaces/pluginregistry-rhel9",
            "product": "Red Hat OpenShift Dev Spaces 3.30",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787759723",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "cryostat-openshift-console-plugin-npm",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:cryostat:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "undici",
            "product": "Cryostat 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-pf5-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-rhel8",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_pipelines:1"
            ],
            "defaultStatus": "affected",
            "packageName": "openshift-pipelines/pipelines-console-plugin-rhel9",
            "product": "OpenShift Pipelines",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:podman_desktop:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rh-podman-desktop.git",
            "product": "Red Hat Build of Podman Desktop",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "nodejs25",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "rust",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-dashboard-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-automl-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-autorag-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-eval-hub-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-gen-ai-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-maas-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "unaffected",
            "packageName": "rhoai/odh-mod-arch-mlflow-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift_ai"
            ],
            "defaultStatus": "affected",
            "packageName": "rhoai/odh-mod-arch-model-registry-rhel9",
            "product": "Red Hat OpenShift AI (RHOAI)",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-agent-installer-ui-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:openshift:4"
            ],
            "defaultStatus": "unaffected",
            "packageName": "openshift4/ose-console-rhel9",
            "product": "Red Hat OpenShift Container Platform 4",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/automation-portal",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/bootc-automation-portal-rhel9",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-06-17T16:05:38.785Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in undici. A malicious WebSocket server can exploit this by streaming numerous small or empty continuation frames. This can bypass per-frame and cumulative-size validation, leading to unbounded memory growth in the client process. The primary consequence is memory exhaustion, resulting in a denial of service (DoS) for affected applications using the undici WebSocket client or WebSocketStream API."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-770",
                "description": "Allocation of Resources Without Limits or Throttling",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-11T12:08:59.030Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-12151"
          },
          {
            "name": "RHBZ#2489980",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2489980"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-12151.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:48151"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39246"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35842"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35841"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41947"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:39868"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:52399"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35892"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35891"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34342"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66545"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:66488"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36754"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:41929"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38236"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:38009"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:65126"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:60520"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36621"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47728"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:48124"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:36820"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:62260"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56431"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:56366"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:57013"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:48151: Cryostat 4 on RHEL 9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39246: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35842: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35841: Red Hat Enterprise Linux AppStream (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41947: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:39868: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:52399: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35892: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35891: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34342: Cluster Observability Operator 1.5.0"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66545: Red Hat AMQ Broker 7.13.6"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:66488: Red Hat AMQ Broker 7.14.1"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36754: Red Hat Developer Hub 1.10"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:41929: Red Hat Developer Hub 1.9"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38236: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:38009: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:65126: Red Hat OpenShift AI 2.25"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:60520: Red Hat OpenShift AI 3.4"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36621: Red Hat OpenShift Container Platform 4.16"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47728: Red Hat OpenShift Container Platform 4.17"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:48124: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:62260: Red Hat OpenShift Dev Spaces 3.30"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56431: Red Hat Openshift Data Foundation 4.18"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:56366: Red Hat Openshift Data Foundation 4.19"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:57013: Red Hat Openshift Data Foundation 4.20"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-06-17T17:01:45.297Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-06-17T16:05:38.785Z",
            "value": "Made public."
          }
        ],
        "title": "undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames",
        "workarounds": [
          {
            "lang": "en",
            "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.26.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.26.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.28.0",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.28.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "lpinca"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Nadav0077"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Impact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nAll releases starting at undici 6.17.0 are affected.\n\nPatches:\u0026nbsp;Upgrade to undici \u0026gt;= 6.26.0, \u0026gt;= 7.28.0, or \u0026gt;= 8.5.0.\u0026nbsp;Workarounds:\nNo workaround is available. The fix must be applied through an upgrade."
            }
          ],
          "value": "Impact:\nThe undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service.\n\nAffected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint.\n\nAll releases starting at undici 6.17.0 are affected.\n\nPatches:\u00a0Upgrade to undici \u003e= 6.26.0, \u003e= 7.28.0, or \u003e= 8.5.0.\u00a0Workarounds:\nNo workaround is available. The fix must be applied through an upgrade."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-400",
              "description": "CWE-400: Uncontrolled Resource Consumption",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T16:05:38.785Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-vxpw-j846-p89q"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici WebSocket client vulnerable to denial of service via fragment count bypass",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-12151",
    "datePublished": "2026-06-17T16:05:38.785Z",
    "dateReserved": "2026-06-12T18:14:04.454Z",
    "dateUpdated": "2026-09-11T12:08:59.030Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-5078 (GCVE-0-2026-5078)

Vulnerability from cvelistv5 – Published: 2026-06-03 05:56 – Updated: 2026-06-03 13:19

Title

morgan vulnerable to Log Forging via unneutralized control characters in :remote-user

Summary

Impact: The morgan logging middleware's :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-03 13:16 UTC

CWE

CWE-117 - Improper Output Neutralization for Logs

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/expressjs/morgan/security/advi…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
morgan	morgan	Affected: 1.2.0 , ≤ 1.10.1 (semver) Unaffected: 1.11.0 (semver)

Credits

Yuki Matsuhashi Ulises Gascón Jon Church

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-5078",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-03T13:16:59.663217Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-03T13:19:32.922Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/morgan",
          "product": "morgan",
          "vendor": "morgan",
          "versions": [
            {
              "lessThanOrEqual": "1.10.1",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Yuki Matsuhashi"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Ulises Gasc\u00f3n"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jon Church"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Impact: The morgan logging middleware\u0027s :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user."
            }
          ],
          "value": "Impact: The morgan logging middleware\u0027s :remote-user token extracts the Basic auth username from the Authorization request header and writes it to the log stream without neutralizing control characters. An unauthenticated attacker can send a crafted Authorization Basic header containing CR or LF bytes to inject forged log lines, breaking the one-request-per-line structure of access logs and enabling log forgery against downstream log consumers. The built-in combined, common, default, and short formats are affected, as well as any custom format that references :remote-user. Affected versions: morgan 1.2.0 through 1.10.1. Patches: upgrade to morgan 1.11.0, which neutralizes control characters in the :remote-user token output. Workarounds: use a custom format string that does not include :remote-user."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-117",
              "description": "CWE-117: Improper Output Neutralization for Logs",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T05:56:49.512Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/expressjs/morgan/security/advisories/GHSA-4vj7-5mj6-jm8m"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "morgan vulnerable to Log Forging via unneutralized control characters in :remote-user",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-5078",
    "datePublished": "2026-06-03T05:56:49.512Z",
    "dateReserved": "2026-03-28T17:42:51.328Z",
    "dateUpdated": "2026-06-03T13:19:32.922Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6733 (GCVE-0-2026-6733)

Vulnerability from cvelistv5 – Published: 2026-06-17 17:14 – Updated: 2026-06-17 18:30

Title

undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse

Summary

Impact: Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests. This requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: Disable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 18:30 UTC

CWE

CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://hackerone.com/reports/3582376
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 0 , < 6.26.0 (semver) Unaffected: 6.26.0 (semver) Affected: 7.0.0 , < 7.28.0 (semver) Unaffected: 7.28.0 (semver) Affected: 8.0.0 , < 8.5.0 (semver) Unaffected: 8.5.0 (semver)

Credits

mcollina UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6733",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T18:30:07.748616Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T18:30:26.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.26.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.26.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.28.0",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.28.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation verifier",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Impact:\nUndici\u0027s HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nDisable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool."
            }
          ],
          "value": "Impact:\nUndici\u0027s HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket after a request completes. When the client dispatches the next request on that socket, it associates the injected response with the new request, causing responses to be delivered to the wrong requests.\n\nThis requires an attacker-controlled or compromised upstream HTTP/1.1 server and keep-alive connection reuse.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nDisable keep-alive connection reuse by setting keepAliveTimeout: 0 on the Client or Pool."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T17:14:50.991Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-35p6-xmwp-9g52"
        },
        {
          "url": "https://hackerone.com/reports/3582376"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-6733",
    "datePublished": "2026-06-17T17:14:50.991Z",
    "dateReserved": "2026-04-20T22:44:32.835Z",
    "dateUpdated": "2026-06-17T18:30:26.429Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-9679 (GCVE-0-2026-9679)

Vulnerability from cvelistv5 – Published: 2026-06-17 16:56 – Updated: 2026-06-23 16:12

Title

undici vulnerable to HTTP header injection via Set-Cookie percent-decoding

Summary

Impact: undici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either. Applications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning. Affected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header. This was introduced in undici 7.0.0 via PR #3789. Patches: Upgrade to undici v6.26.0, v7.28.0 or v8.5.0. Workarounds: If upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 18:31 UTC

CWE

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')

Assigner

openjs CNA under the redhat root

CNA scorecard C 66/100 over 142 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/nodejs/undici/security/advisor…
https://cna.openjsf.org/security-advisories.html

Impacted products

1 product

Vendor	Product	Version
undici	undici	Affected: 0 , < 6.26.0 (semver) Unaffected: 6.26.0 (semver) Affected: 7.0.0 , < 7.28.0 (semver) Unaffected: 7.28.0 (semver) Affected: 8.0.0 , < 8.5.0 (semver) Unaffected: 8.5.0 (semver)

Credits

tndud042713 mcollina KhafraDev UlisesGascon

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-9679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T18:31:46.100353Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T16:12:38.765Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:npm/undici",
          "product": "undici",
          "vendor": "undici",
          "versions": [
            {
              "lessThan": "6.26.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.26.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.28.0",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.28.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.5.0",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "8.5.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "tndud042713"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "mcollina"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "KhafraDev"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "UlisesGascon"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Impact:\nundici\u0027s cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 \u00a75.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application\u0027s downstream response, enabling session fixation, open redirect, or cache poisoning.\n\nAffected applications are those that use undici\u0027s cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.\n\nThis was introduced in undici 7.0.0 via PR #3789.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nIf upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes."
            }
          ],
          "value": "Impact:\nundici\u0027s cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 \u00a75.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application\u0027s downstream response, enabling session fixation, open redirect, or cache poisoning.\n\nAffected applications are those that use undici\u0027s cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.\n\nThis was introduced in undici 7.0.0 via PR #3789.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nIf upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-93",
              "description": "CWE-93: Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T16:56:18.579Z",
        "orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
        "shortName": "openjs"
      },
      "references": [
        {
          "url": "https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv"
        },
        {
          "url": "https://cna.openjsf.org/security-advisories.html"
        }
      ],
      "title": "undici vulnerable to HTTP header injection via Set-Cookie percent-decoding",
      "x_generator": {
        "engine": "cve-kit 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
    "assignerShortName": "openjs",
    "cveId": "CVE-2026-9679",
    "datePublished": "2026-06-17T16:56:18.579Z",
    "dateReserved": "2026-05-27T08:59:17.316Z",
    "dateUpdated": "2026-06-23T16:12:38.765Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:38009

CVE-2026-11525 (GCVE-0-2026-11525)

CVE-2026-12151 (GCVE-0-2026-12151)

CVE-2026-5078 (GCVE-0-2026-5078)

CVE-2026-6733 (GCVE-0-2026-6733)

CVE-2026-9679 (GCVE-0-2026-9679)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour