UBUNTU-CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-84933

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-84933 undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-84933 undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-84933

undici , the Node.js HTTP client library, has a flaw in its cache interceptor that fails to handle the Set-Cookie response header in its cache path—neither refusing to store nor stripping it. In shared cache mode (the default), a cacheable response carrying a Set-Cookie header is stored and re-se...

CVE-2026-84933 undici vulnerable to cross-user cookie disclosure via Set-Cookie caching in shared caches

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...

CVE-2026-80813

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix NULL pointer dereference in nvmetexecuteidentifynslist When a host issues an Identify command with CNS 07h Active Namespace ID List for a specific I/O Command Set, nvmetexecuteidentifynslist is called with matchcss set...

CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

CVE-2026-80763

CVE-2026-80763 is an out-of-bounds read in the Linux kernel Bluetooth HCI subsystem. In hci_cc_le_set_cig_params(), the handler trusts the num_handles field of the LE Set CIG Parameters Command Complete response and reads the trailing handle array without verifying that the remaining skb data act...

CVE-2026-80763 Bluetooth: hci_event: validate LE Set CIG Parameters response

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

CVE-2026-80763: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hcicclesetcigparams trusts...

PT-2026-91367

In the Linux kernel, the following vulnerability has been resolved: ext4: stop retrying saturated xattr cache entries ext4 xattr block set retries when a cache entry selected for reuse has a saturated reference count after taking the buffer lock. The retry returns to the mbcache lookup without...

PT-2026-91360

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci cc le set cig params...

PT-2026-91300

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hid set field hid set field hands field-usage + offset to hid dump input before the guard that bounds offset: hid dump inputfield-report-device, field-usage + offset, value; if offset =...

PT-2026-91791

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transport header when sending VLAN-tagged frame In packet parse headers, when processing a VLAN-tagged frame, skb set network header is called to advance network header past the VLAN tag to the inner protoc...

PT-2026-86267

PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param set default file and param set backup file functions that allows attackers to crash the autopilot process. Attackers can invoke 'param select' or 'param select-backup' commands with no path argument from any P...

PT-2026-85622

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix OOB read of field-usage in hid set field hid set field hands field-usage + offset to hid dump input before the guard that bounds offset: hid dump inputfield-report-device, field-usage + offset, value; if offset =...

PT-2026-85604

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci event: validate LE Set CIG Parameters response The Command Complete dispatch validates only the fixed part of the LE Set CIG Parameters response. After that part is pulled from the skb, hci cc le set cig params...

PT-2026-86152

Name of the Vulnerable Software and Affected Versions undici versions 7.0.0 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The cache interceptor fails to handle the Set-Cookie response header, allowing it to be stored and re-served in shared cache mode. This occurs when a cacheab...

CVE-2026-84933: Exposure of Sensitive Information to an Unauthorized Actor

undici's cache interceptor does not handle the Set-Cookie response header anywhere in its cache path, so it neither refuses to store nor strips that header. In shared cache mode, which is the default, an otherwise cacheable response that carries a Set-Cookie header, for example one marked with a...