Lucene search
+L

24194 matches found

OSV
OSV
added 2026/07/29 10:16 p.m.5 views

UBUNTU-CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

7.5CVSS7.1AI score0.00231EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/07/29 10:7 p.m.5 views

undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives

A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a...

9.1CVSS7.1AI score0.00325EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/29 10:7 p.m.6 views

undici: undici: Cross-user information disclosure due to improper Cache-Control directive parsing

A flaw was found in undici. The cache interceptor in undici improperly handles optional whitespace around the equals sign in no-cache or private Cache-Control directives. This vulnerability allows an attacker to bypass cache restrictions, leading to cross-user information disclosure. Specifically...

7.5CVSS7.1AI score0.00231EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/29 9:8 p.m.62 views

CVE-2026-14643 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

5.9CVSS0.00231EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/07/29 9:8 p.m.6 views

CVE-2026-14643 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

5.9CVSS5.8AI score0.00231EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/29 9:8 p.m.47 views

CVE-2026-14643

undici contains a cache-interceptor vulnerability where optional whitespace around the = in qualified no-cache or private Cache-Control directives is not normalized. In affected releases (7.0.0–7.28.x and 8.0.0–8.8.x), the parser may drop the directive or store a quoted field name, causing a cach...

7.5CVSS5.8AI score0.00231EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/07/29 9:8 p.m.5 views

CVE-2026-14643 undici vulnerable to cross-user information disclosure via whitespace around equals in Cache-Control directives

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

5.9CVSS5.5AI score
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/29 9:8 p.m.14 views

CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

5.9CVSS5.8AI score0.00231EPSS
SaveExploits0References3Affected Software1
Debian CVE
Debian CVE
added 2026/07/29 9:8 p.m.7 views

CVE-2026-14643

undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no-cache or private Cache-Control directive. In undici from 7.0.0 up to before 7.29.0 and from 8.0.0 up to before 8.9.0, the parser either drops the directive or stores a field name with literal...

7.5CVSS5.8AI score0.00231EPSS
SaveExploits0
Snyk
Snyk
added 2026/07/29 5:46 p.m.9 views

Information Exposure

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Information Exposure via the cache-control parser in lib/util/cache.js used by interceptors.cache. An attacker can cause a private response to be stored in the shared...

9.1CVSS7.2AI score0.00325EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/29 5:16 p.m.6 views

CVE-2026-13697

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...

9.1CVSS0.00325EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/29 5:16 p.m.7 views

UBUNTU-CVE-2026-13697

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...

9.1CVSS7.1AI score0.00325EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2026/07/29 4:32 p.m.6 views

CVE-2026-13697

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...

9.1CVSS5.8AI score0.00325EPSS
SaveExploits0
Vulnrichment
Vulnrichment
added 2026/07/29 4:32 p.m.6 views

CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...

7.4CVSS5.8AI score0.00325EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/29 4:32 p.m.6 views

CVE-2026-13697

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...

7.4CVSS5.8AI score0.00325EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2026/07/29 4:32 p.m.101 views

CVE-2026-13697

Summary of a known vulnerability in undici (CVE-2026-13697) : The cache interceptor in undici mishandles degenerate private directives in Cache-Control, enabling two issues in shared mode. First, a response with malformed qualified private directives (for example, private="" or private=",") can b...

9.1CVSS5.8AI score0.00325EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 2026/07/29 4:32 p.m.52 views

CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...

7.4CVSS0.00325EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/29 4:32 p.m.5 views

CVE-2026-13697 undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and...

7.4CVSS5.5AI score
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/07/29 2:7 p.m.6 views

CVE-2026-64288

A flaw was found in the kernel's Kernel-based Virtual Machine KVM component for ARM64 architectures. A race condition can occur during the invalidation of the virtual Nested Translation Cache VNCR pseudo-TLB when a virtual CPU vcpu is being brought online or offline. This can lead to a null point...

5.5CVSS5.8AI score0.00198EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/07/29 1:21 p.m.6 views

CVE-2026-41710

A flaw was found in Spring Retry. A remote attacker can craft a large number of unique requests, leading to the exhaustion of the application-wide stateful retry cache. Once the cache is full, it permanently rejects further updates, causing all subsequent stateful retries and circuit breakers in...

5.9CVSS5.8AI score0.0028EPSS
SaveExploits0References4
Rows per page
Query Builder