RHSA-2026:66008
Vulnerability from csaf_redhat - Published: 2026-09-09 13:42 - Updated: 2026-09-10 09:01Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
grafana12.4:
* grafana12.4-12.4.10-0.2.hum1 (aarch64, x86_64)
* grafana12.4-12.4.10-0.2.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici's retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to pending promises and streams accumulating, which can exhaust application resources and result in a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an application relaying such a response to a downstream HTTP/1.1 peer without proper framing normalization may enable HTTP response splitting or desynchronization, allowing an attacker to inject arbitrary content into subsequent responses.
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).
7.5 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in undici. The decompress interceptor in undici processes compressed response bodies based on the untrusted Content-Encoding header. A remote attacker can exploit this by sending a small, specially crafted compressed payload, known as a 'compression bomb,' which expands significantly in client memory. This unbounded decompression can lead to memory exhaustion and cause the application to crash, resulting in a Denial of Service (DoS).
5.9 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in undici. The software's caching mechanism, when operating in shared cache mode, improperly stores responses that include 'Set-Cookie' headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one user can be inadvertently disclosed to another user accessing the same cached content.
6.5 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in undici, a Node.js HTTP/1.1 client. When the dump interceptor processes oversized chunked responses that do not declare a Content-Length, it prematurely signals completion. This causes the application to receive an incomplete or empty response body, while the network connection is unexpectedly closed. This issue can lead to applications processing partial data or encountering unexpected connection disruptions.
6.5 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in undici's BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.
7.4 (High)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in undici. The cache interceptor incorrectly caches responses to unsafe HTTP methods, such as POST, PUT, or DELETE. A remote attacker can exploit this by providing a cacheable response, leading to subsequent state-changing requests being served from a stale cache entry without reaching the origin. This can result in an integrity failure, where the client's application state is not updated as expected.
CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service (DoS) by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the termination of the entire Node.js process.
5.9 (Medium)
Affected products
Fixed
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:grafana12-4-main@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
References
59 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\ngrafana12.4:\n * grafana12.4-12.4.10-0.2.hum1 (aarch64, x86_64)\n * grafana12.4-12.4.10-0.2.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:66008",
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84961",
"url": "https://access.redhat.com/security/cve/CVE-2026-84961"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-19534",
"url": "https://access.redhat.com/security/cve/CVE-2026-19534"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-18540",
"url": "https://access.redhat.com/security/cve/CVE-2026-18540"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84933",
"url": "https://access.redhat.com/security/cve/CVE-2026-84933"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-18149",
"url": "https://access.redhat.com/security/cve/CVE-2026-18149"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84947",
"url": "https://access.redhat.com/security/cve/CVE-2026-84947"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85008",
"url": "https://access.redhat.com/security/cve/CVE-2026-85008"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-84890",
"url": "https://access.redhat.com/security/cve/CVE-2026-84890"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-85014",
"url": "https://access.redhat.com/security/cve/CVE-2026-85014"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_66008.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-09-10T09:01:37+00:00",
"generator": {
"date": "2026-09-10T09:01:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.18"
}
},
"id": "RHSA-2026:66008",
"initial_release_date": "2026-09-09T13:42:29+00:00",
"revision_history": [
{
"date": "2026-09-09T13:42:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-09T14:11:03+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-10T09:01:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12-4-main@aarch64",
"product": {
"name": "grafana12-4-main@aarch64",
"product_id": "grafana12-4-main@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.10-0.2.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12-4-main@src",
"product": {
"name": "grafana12-4-main@src",
"product_id": "grafana12-4-main@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.10-0.2.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana12-4-main@x86_64",
"product": {
"name": "grafana12-4-main@x86_64",
"product_id": "grafana12-4-main@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/grafana12.4@12.4.10-0.2.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12-4-main@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12-4-main@aarch64"
},
"product_reference": "grafana12-4-main@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12-4-main@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12-4-main@src"
},
"product_reference": "grafana12-4-main@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana12-4-main@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:grafana12-4-main@x86_64"
},
"product_reference": "grafana12-4-main@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-18149",
"cwe": {
"id": "CWE-911",
"name": "Improper Update of Reference Count"
},
"discovery_date": "2026-09-04T17:34:19.339068+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528802"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote attacker, by controlling a server, could exploit a vulnerability in undici\u0027s retry handler. When a server sends an incomplete response body and then a non-retryable status, the original response body can become orphaned and never properly closed. This leads to pending promises and streams accumulating, which can exhaust application resources and result in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service due to orphaned response body in retry handler",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An attacker-controlled server can trigger a denial of service in applications using undici\u0027s retry handler. This vulnerability allows for resource exhaustion by leaving response bodies orphaned, which can lead to a degradation of service availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18149"
},
{
"category": "external",
"summary": "RHBZ#2528802",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528802"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18149"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x"
}
],
"release_date": "2026-09-04T17:21:46.263000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Applications utilizing undici should implement an independent request deadline and ensure the response body is explicitly destroyed upon expiration. The bodyTimeout mechanism alone is insufficient to prevent resource exhaustion in this scenario.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service due to orphaned response body in retry handler"
},
{
"cve": "CVE-2026-18540",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-04T17:26:35.687862+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528783"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. An attacker-controlled upstream server can exploit a vulnerability in the retry interceptor, which incorrectly appends data to a ranged retry response. This can cause the response body to be longer than the Content-Length observed by the application. Consequently, an application relaying such a response to a downstream HTTP/1.1 peer without proper framing normalization may enable HTTP response splitting or desynchronization, allowing an attacker to inject arbitrary content into subsequent responses.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: HTTP response splitting via retry interceptor",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18540"
},
{
"category": "external",
"summary": "RHBZ#2528783",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528783"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18540",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18540"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18540",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18540"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-r53p-7pc4-xj5r"
}
],
"release_date": "2026-09-04T17:15:50.619000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "undici: undici: HTTP response splitting via retry interceptor"
},
{
"cve": "CVE-2026-19534",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2026-09-04T17:21:01.599799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528759"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. A remote attacker can exploit this vulnerability by responding with an unrequested WebSocket subprotocol during the opening handshake. This causes the undici WebSocket client to crash the entire Node.js process, leading to a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unrequested WebSocket subprotocol",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw in undici\u0027s WebSocket client, which can lead to a Node.js process crash. The vulnerability is triggered when an application connects to a malicious or compromised server that responds with an unrequested WebSocket subprotocol, allowing a remote, unauthenticated attacker to cause a denial of service in affected Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-19534"
},
{
"category": "external",
"summary": "RHBZ#2528759",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528759"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-19534",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19534"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19534"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rfgv-xxqx-mfg5"
}
],
"release_date": "2026-09-04T17:10:05.081000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: Denial of Service via unrequested WebSocket subprotocol"
},
{
"cve": "CVE-2026-84890",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-09-04T17:23:53.949898+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528772"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. The decompress interceptor in undici processes compressed response bodies based on the untrusted Content-Encoding header. A remote attacker can exploit this by sending a small, specially crafted compressed payload, known as a \u0027compression bomb,\u0027 which expands significantly in client memory. This unbounded decompression can lead to memory exhaustion and cause the application to crash, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via unbounded decompression of compressed responses",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The undici library, used in some Red Hat products, is vulnerable to a denial of service. This occurs when processing untrusted compressed HTTP responses, which can lead to unbounded memory consumption and application crashes. The Moderate severity is due to the requirement of a malicious or faulty upstream server to deliver a specially crafted \u0027compression bomb\u0027 payload.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84890"
},
{
"category": "external",
"summary": "RHBZ#2528772",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528772"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84890"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84890",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84890"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-3xpg-4rpp-hhhm"
}
],
"release_date": "2026-09-04T17:04:28.261000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service via unbounded decompression of compressed responses"
},
{
"cve": "CVE-2026-84933",
"cwe": {
"id": "CWE-524",
"name": "Use of Cache Containing Sensitive Information"
},
"discovery_date": "2026-09-04T17:10:59.058130+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528756"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. The software\u0027s caching mechanism, when operating in shared cache mode, improperly stores responses that include \u0027Set-Cookie\u0027 headers. This oversight allows an untrusted server to inject cookies into cached responses. Consequently, sensitive cookie information from one user can be inadvertently disclosed to another user accessing the same cached content.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Cross-user cookie disclosure via Set-Cookie caching",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84933"
},
{
"category": "external",
"summary": "RHBZ#2528756",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528756"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84933",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84933"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84933",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84933"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2jfj-6hjv-fm6j"
}
],
"release_date": "2026-09-04T16:59:08.807000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Cross-user cookie disclosure via Set-Cookie caching"
},
{
"cve": "CVE-2026-84947",
"cwe": {
"id": "CWE-130",
"name": "Improper Handling of Length Parameter Inconsistency"
},
"discovery_date": "2026-09-04T17:01:36.613728+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528754"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici, a Node.js HTTP/1.1 client. When the dump interceptor processes oversized chunked responses that do not declare a Content-Length, it prematurely signals completion. This causes the application to receive an incomplete or empty response body, while the network connection is unexpectedly closed. This issue can lead to applications processing partial data or encountering unexpected connection disruptions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: Undici: Response truncation and connection termination",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84947"
},
{
"category": "external",
"summary": "RHBZ#2528754",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528754"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84947",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84947"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84947",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84947"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2gqq-gqf2-x968"
}
],
"release_date": "2026-09-04T16:53:11.716000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: Undici: Response truncation and connection termination"
},
{
"cve": "CVE-2026-84961",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-09-04T16:52:40.440125+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528735"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici\u0027s BalancedPool component. This vulnerability allows a remote attacker to bypass Transport Layer Security (TLS) certificate validation. The BalancedPool constructor incorrectly processes its options, silently discarding custom certificate validation functions. Consequently, a peer with an otherwise untrusted certificate may be accepted, potentially compromising the integrity of secure communication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-84961"
},
{
"category": "external",
"summary": "RHBZ#2528735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528735"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-84961",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-84961"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-84961",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84961"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-w293-vg96-wgc3"
}
],
"release_date": "2026-09-04T16:47:55.724000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options"
},
{
"cve": "CVE-2026-85008",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-09-04T16:55:29.468757+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528747"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici. The cache interceptor incorrectly caches responses to unsafe HTTP methods, such as POST, PUT, or DELETE. A remote attacker can exploit this by providing a cacheable response, leading to subsequent state-changing requests being served from a stale cache entry without reaching the origin. This can result in an integrity failure, where the client\u0027s application state is not updated as expected.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Integrity failure due to caching of unsafe HTTP method responses",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85008"
},
{
"category": "external",
"summary": "RHBZ#2528747",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528747"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85008",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85008"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85008",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85008"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-8436-99hf-9mmv"
}
],
"release_date": "2026-09-04T16:42:40.780000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "undici: undici: Integrity failure due to caching of unsafe HTTP method responses"
},
{
"cve": "CVE-2026-85014",
"cwe": {
"id": "CWE-390",
"name": "Detection of Error Condition Without Action"
},
"discovery_date": "2026-09-04T16:41:09.987760+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2528712"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in undici\u0027s experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service (DoS) by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the termination of the entire Node.js process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "undici: undici: Denial of Service via WebSocketStream unclean close",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in the `undici` library\u0027s experimental `WebSocketStream` client can lead to a denial of service. An untrusted remote server can crash a vulnerable Node.js client application by abruptly closing a TCP connection without a WebSocket handshake. This affects the availability of applications utilizing `undici` in Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-85014"
},
{
"category": "external",
"summary": "RHBZ#2528712",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2528712"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-85014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-85014"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-85014",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85014"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq",
"url": "https://github.com/nodejs/undici/security/advisories/GHSA-rx4f-c7p8-82vq"
}
],
"release_date": "2026-09-04T16:30:07.996000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-09T13:42:29+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:66008"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:grafana12-4-main@aarch64",
"Red Hat Hardened Images:grafana12-4-main@src",
"Red Hat Hardened Images:grafana12-4-main@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "undici: undici: Denial of Service via WebSocketStream unclean close"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…