CLEANSTART-2026-HI60053 undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response

CVE-2026-16728 affects multiple packages. undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. See references for individual vulnerability details...

Security Bulletin: undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-15157 DESCRIPTION: undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before...

EulerOS 2.0 SP15 : haproxy (EulerOS-SA-2026-2886)

According to the versions of the haproxy packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue was discovered in HAProxy before 3.3.6. The HTTP/3 parser does not check that the received body length matches a previously announced...

CVE-2026-16728

undici's retry interceptor can deliver a response whose body length does not match the Content-Length header exposed to the application after a retry or resume of a partial response. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a malicious or faulty...

CVE-2026-33555

A flaw was found in HAProxy. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/3 request. The HTTP/3 parser fails to verify that the received body length matches the announced content-length when a stream is closed with an empty payload. This desynchronization...