undici: undici: Denial of Service via TLS renegotiation with mismatched certificate

A flaw was found in undici. A remote server can cause a Denial of Service DoS by initiating a Transport Layer Security TLS renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught...

cve-2009-3555-test-server

What is this? This is a TLS server using a vendored fork of the Go TLS stack that has renegotation indication extension forcibly disabled, which will trigger CVE-2009-3555 mitigations in OpenSSL 3.0+. Note that it isn't truly vulnerable to CVE-2009-3555 because the Go TLS stack doesn't allow...

undici: undici: Denial of Service via TLS renegotiation with mismatched certificate

A flaw was found in undici. A remote server can cause a Denial of Service DoS by initiating a Transport Layer Security TLS renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught...

bash-tls-reneg-attack

bash-tls-reneg-attack A bash script that attempts to flood a server with TLS renegotiations by using the openssl client. See CVE-2011-1473 and CVE-2011-1473 for details. Usage: ./tls-reneg.sh some.hostname.here:port...

UBUNTU-CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

Linux Distros Unpatched Vulnerability : CVE-2026-87018

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when ...

CVE-2026-87018

A flaw was found in undici. A remote server can cause a Denial of Service DoS by initiating a Transport Layer Security TLS renegotiation and presenting a certificate with a mismatched hostname. Because the client application fails to properly handle the resulting verification error, an uncaught...

DEBIAN-CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

CVE-2026-87018

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

CVE-2026-87018 undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

CVE-2026-87018

The undici HTTP client library for Node.js is vulnerable to a Denial of Service (DoS) in versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1. The root cause is an uncaught assertion triggered when a TLS 1.2 server performs a certificate-changing renegotiation. If the ser...

cve-2021-3449

CVE-2021-3449 OpenSSL This issue was reported to OpenSSL on 17th March 2021 by Nokia. The fix was developed by Peter Kästle and Samuel Sapalski from Nokia. Mitigation The only known fix is to update libssl1.1. Even though some applications use hardened TLS configurations by default that disable T...

CVE-2026-87018: Uncaught Exception

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

PT-2026-115209

undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does no...

Astra Linux – Vulnerability in freerdp3, freerdp2

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.22.0, the renegotiation of the AUDIN format freed the active format list, while the capture thread continued to use audin-format. This led to a use after free in audioformatcompatible. This vulnerability has been...

russh: russh: Denial of Service via unbounded memory exhaustion during stalled key renegotiation

A flaw was found in russh. An authenticated remote attacker can cause a Denial of Service DoS by initiating a Secure Shell SSH key renegotiation without completing it and flooding the server with channel open requests. Because the server continues buffering incoming requests without draining the...

Rocky Linux 8 [CIQ] Security Update: spice-debugsource / spice-server / spice-server-debuginfo / etc (crlsa-2021_1924)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20211924 advisory. spice: Client initiated renegotiation denial of service CVE-2021-20201 Tenable has extracted the preceding description block directly from the CIQ security advisory...

CVE-2026-102821

A flaw was found in russh. An authenticated remote attacker can cause a Denial of Service DoS by initiating a Secure Shell SSH key renegotiation without completing it and flooding the server with channel open requests. Because the server continues buffering incoming requests without draining the...

PT-2026-97310

Name of the Vulnerable Software and Affected Versions Apache Tomcat Native versions 1.3.0 through 1.3.8 Apache Tomcat Native versions 2.0.0 through 2.0.15 Description Apache Tomcat Native enables several insecure OpenSSL options by default. These include ALLOW CLIENT RENEGOTIATION, NO EXTENDED...