184 matches found
CLEANSTART-2024-AS26968 When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata
Security vulnerability affects the librewolf package. When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entries with incorrect, different integrity metadata...
SSR-DNSSEC
The DNS infrastructure used for this PoC was the one suggested on the SEED Labs, available at: https://seedsecuritylabs.org/Labs20.04/Networking/DNS/DNSSEC/, with some minor changes. The infrastructure, consists of a root server, a top-level domain server for edu, a domain server for example.edu,...
Undici Vulnerable To Subresource Integrity Bypass Via Non-lowercase Algorithm Tokens
Impact undici's "fetch" verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as "SHA256-..." or "Sha256-..." is therefore treated a...
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
Impact undici's fetch verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as...
npm: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
npm: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens vulnerability discovered by ? in WordPress npm undici versions = 7.15.0, 7.30.1...
EUVD-2026-102305
undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens...
GHSA-F72V-6W45-Q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
Impact undici's fetch verifies Subresource Integrity SRI metadata by looking up the algorithm token in a lowercase-only set, but the SRI specification defines a valid token by its ASCII-lowercase form. A correct but non-lowercase token such as SHA256-... or Sha256-... is therefore treated as...
grafana: Grafana: Unauthorized configuration modification via status subresource
A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...
SUSE CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
grafana: Grafana: Unauthorized configuration modification via status subresource
A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...
undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens
A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity SRI algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing i...
undici: undici: Subresource Integrity bypass via non-lowercase algorithm tokens
A flaw was found in undici. The HTTP client improperly handles case sensitivity when verifying Subresource Integrity SRI algorithm tokens. When an application specifies an uppercase or mixed-case algorithm name, undici treats the token as unrecognized and skips verification instead of enforcing i...
grafana: Grafana: Unauthorized configuration modification via status subresource
A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...
UBUNTU-CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
Linux Distros Unpatched Vulnerability : CVE-2026-109841
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrit...
Improper Handling of Case Sensitivity
Overview org.webjars.npm:undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch implementation's Subresource Integrity SRI verification logic, which matches the algorithm token again...
Improper Handling of Case Sensitivity
Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch implementation's Subresource Integrity SRI verification logic, which matches the algorithm token against a...
DEBIAN-CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...
CVE-2026-109841
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its fetch implementation verifies Subresource Integrity metadata by matching the algorithm token against a lowercase-only set, even though the SRI specification defines the token by its...