CVE-2026-1525

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1525", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-01-28T12:04:51.369Z", "datePublished": "2026-03-12T19:56:55.092Z", "dateUpdated": "2026-03-12T20:46:13.379Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-03-12T19:56:55.092Z"}, "title": "undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-444", "description": "CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-33", "descriptions": [{"lang": "en", "value": "CAPEC-33 HTTP Request Smuggling"}]}, {"capecId": "CAPEC-273", "descriptions": [{"lang": "en", "value": "CAPEC-273 HTTP Response Smuggling"}]}], "affected": [{"vendor": "undici", "product": "undici", "collectionURL": "https://github.com/nodejs/undici/", "packageName": "undici", "repo": "https://github.com/nodejs/undici/", "versions": [{"status": "affected", "version": "< 6.24.0; 7.0.0 < 7.24.0"}, {"status": "unaffected", "version": "6.24.0: 7.24.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Undici allows duplicate HTTP\u00a0Content-Length\u00a0headers when they are provided in an array with case-variant names (e.g.,\u00a0Content-Length\u00a0and\u00a0content-length). This produces malformed HTTP/1.1 requests with multiple conflicting\u00a0Content-Length\u00a0values on the wire.\n\nWho is impacted:\n\n * Applications using\u00a0undici.request(),\u00a0undici.Client, or similar low-level APIs with headers passed as flat arrays\n * Applications that accept user-controlled header names without case-normalization\n\n\nPotential consequences:\n\n * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate\u00a0Content-Length\u00a0headers (400 Bad Request)\n * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Undici allows duplicate HTTP&nbsp;<code>Content-Length</code>&nbsp;headers when they are provided in an array with case-variant names (e.g.,&nbsp;<code>Content-Length</code>&nbsp;and&nbsp;<code>content-length</code>). This produces malformed HTTP/1.1 requests with multiple conflicting&nbsp;<code>Content-Length</code>&nbsp;values on the wire.</p><p><strong>Who is impacted:</strong></p><ul><li>Applications using&nbsp;<code>undici.request()</code>,&nbsp;<code>undici.Client</code>, or similar low-level APIs with headers passed as flat arrays</li><li>Applications that accept user-controlled header names without case-normalization</li></ul><p><strong>Potential consequences:</strong></p><ul><li><strong>Denial of Service</strong>: Strict HTTP parsers (proxies, servers) will reject requests with duplicate&nbsp;<code>Content-Length</code>&nbsp;headers (400 Bad Request)</li><li><strong>HTTP Request Smuggling</strong>: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking</li></ul>"}]}], "references": [{"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"}, {"url": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"}, {"url": "https://cwe.mitre.org/data/definitions/444.html"}, {"url": "https://hackerone.com/reports/3556037"}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"}}], "workarounds": [{"lang": "en", "value": "If upgrading is not immediately possible:\n\n * Validate header names: Ensure no duplicate\u00a0Content-Length\u00a0headers (case-insensitive) are present before passing headers to undici\n * Use object format: Pass headers as a plain object ({ 'content-length': '123' }) rather than an array, which naturally deduplicates by key\n * Sanitize user input: If headers originate from user input, normalize header names to lowercase and reject duplicates", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>If upgrading is not immediately possible:</p><ol><li><strong>Validate header names</strong>: Ensure no duplicate&nbsp;<code>Content-Length</code>&nbsp;headers (case-insensitive) are present before passing headers to undici</li><li><strong>Use object format</strong>: Pass headers as a plain object (<code>{ 'content-length': '123' }</code>) rather than an array, which naturally deduplicates by key</li><li><strong>Sanitize user input</strong>: If headers originate from user input, normalize header names to lowercase and reject duplicates</li></ol>"}]}], "credits": [{"lang": "en", "value": "Matteo Collina", "type": "remediation developer"}, {"lang": "en", "value": "Ulises Gasc\u00f3n", "type": "remediation developer"}], "source": {"advisory": "GHSA-2mjp-6q6p-2qxm", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-12T20:44:24.555703Z", "id": "CVE-2026-1525", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T20:46:13.379Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1525", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-12T20:44:24.555703Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-12T20:44:25.316Z"}}], "cna": {"title": "undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "source": {"advisory": "GHSA-2mjp-6q6p-2qxm", "discovery": "INTERNAL"}, "credits": [{"lang": "en", "type": "remediation developer", "value": "Matteo Collina"}, {"lang": "en", "type": "remediation developer", "value": "Ulises Gasc\u00f3n"}], "impacts": [{"capecId": "CAPEC-33", "descriptions": [{"lang": "en", "value": "CAPEC-33 HTTP Request Smuggling"}]}, {"capecId": "CAPEC-273", "descriptions": [{"lang": "en", "value": "CAPEC-273 HTTP Response Smuggling"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/nodejs/undici/", "vendor": "undici", "product": "undici", "versions": [{"status": "affected", "version": "< 6.24.0; 7.0.0 < 7.24.0"}, {"status": "unaffected", "version": "6.24.0: 7.24.0"}], "packageName": "undici", "collectionURL": "https://github.com/nodejs/undici/", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"}, {"url": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"}, {"url": "https://cwe.mitre.org/data/definitions/444.html"}, {"url": "https://hackerone.com/reports/3556037"}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "workarounds": [{"lang": "en", "value": "If upgrading is not immediately possible:\n\n * Validate header names: Ensure no duplicate\u00a0Content-Length\u00a0headers (case-insensitive) are present before passing headers to undici\n * Use object format: Pass headers as a plain object ({ 'content-length': '123' }) rather than an array, which naturally deduplicates by key\n * Sanitize user input: If headers originate from user input, normalize header names to lowercase and reject duplicates", "supportingMedia": [{"type": "text/html", "value": "<p>If upgrading is not immediately possible:</p><ol><li><strong>Validate header names</strong>: Ensure no duplicate&nbsp;<code>Content-Length</code>&nbsp;headers (case-insensitive) are present before passing headers to undici</li><li><strong>Use object format</strong>: Pass headers as a plain object (<code>{ 'content-length': '123' }</code>) rather than an array, which naturally deduplicates by key</li><li><strong>Sanitize user input</strong>: If headers originate from user input, normalize header names to lowercase and reject duplicates</li></ol>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "Undici allows duplicate HTTP\u00a0Content-Length\u00a0headers when they are provided in an array with case-variant names (e.g.,\u00a0Content-Length\u00a0and\u00a0content-length). This produces malformed HTTP/1.1 requests with multiple conflicting\u00a0Content-Length\u00a0values on the wire.\n\nWho is impacted:\n\n * Applications using\u00a0undici.request(),\u00a0undici.Client, or similar low-level APIs with headers passed as flat arrays\n * Applications that accept user-controlled header names without case-normalization\n\n\nPotential consequences:\n\n * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate\u00a0Content-Length\u00a0headers (400 Bad Request)\n * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking", "supportingMedia": [{"type": "text/html", "value": "<p>Undici allows duplicate HTTP&nbsp;<code>Content-Length</code>&nbsp;headers when they are provided in an array with case-variant names (e.g.,&nbsp;<code>Content-Length</code>&nbsp;and&nbsp;<code>content-length</code>). This produces malformed HTTP/1.1 requests with multiple conflicting&nbsp;<code>Content-Length</code>&nbsp;values on the wire.</p><p><strong>Who is impacted:</strong></p><ul><li>Applications using&nbsp;<code>undici.request()</code>,&nbsp;<code>undici.Client</code>, or similar low-level APIs with headers passed as flat arrays</li><li>Applications that accept user-controlled header names without case-normalization</li></ul><p><strong>Potential consequences:</strong></p><ul><li><strong>Denial of Service</strong>: Strict HTTP parsers (proxies, servers) will reject requests with duplicate&nbsp;<code>Content-Length</code>&nbsp;headers (400 Bad Request)</li><li><strong>HTTP Request Smuggling</strong>: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking</li></ul>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')"}]}], "providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-03-12T19:56:55.092Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1525", "state": "PUBLISHED", "dateUpdated": "2026-03-12T20:46:13.379Z", "dateReserved": "2026-01-28T12:04:51.369Z", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "datePublished": "2026-03-12T19:56:55.092Z", "assignerShortName": "openjs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/nodejs/undici/", "defaultStatus": "unaffected", "packageName": "undici", "product": "undici", "repo": "https://github.com/nodejs/undici/", "vendor": "undici", "versions": [{"status": "affected", "version": "< 6.24.0; 7.0.0 < 7.24.0"}, {"status": "unaffected", "version": "6.24.0: 7.24.0"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "C08CE582-019D-4A06-910A-6010C2D6EF4F", "versionEndExcluding": "6.24.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F016E7D9-C45A-4DEF-9AD8-F0581AF5E509", "versionEndExcluding": "7.24.0", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Undici allows duplicate HTTP\u00a0Content-Length\u00a0headers when they are provided in an array with case-variant names (e.g.,\u00a0Content-Length\u00a0and\u00a0content-length). This produces malformed HTTP/1.1 requests with multiple conflicting\u00a0Content-Length\u00a0values on the wire.\n\nWho is impacted:\n\n * Applications using\u00a0undici.request(),\u00a0undici.Client, or similar low-level APIs with headers passed as flat arrays\n * Applications that accept user-controlled header names without case-normalization\n\n\nPotential consequences:\n\n * Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate\u00a0Content-Length\u00a0headers (400 Bad Request)\n * HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking"}, {"lang": "es", "value": "Undici permite encabezados HTTP Content-Length duplicados cuando se proporcionan en un array con nombres que var\u00edan en may\u00fasculas/min\u00fasculas (p. ej., Content-Length y content-length). Esto produce solicitudes HTTP/1.1 malformadas con m\u00faltiples valores Content-Length conflictivos en la red.\n\nQui\u00e9nes son los afectados:\n\n * Aplicaciones que utilizan undici.request(), undici.Cliente, o APIs de bajo nivel similares con encabezados pasados como arrays planos\n * Aplicaciones que aceptan nombres de encabezado controlados por el usuario sin normalizaci\u00f3n de may\u00fasculas/min\u00fasculas\n\nPosibles consecuencias:\n\n * Denegaci\u00f3n de Servicio: Analizadores HTTP estrictos (proxies, servidores) rechazar\u00e1n las solicitudes con encabezados Content-Length duplicados (400 Solicitud Incorrecta)\n * Contrabando de Solicitudes HTTP: En implementaciones donde un intermediario y un backend interpretan encabezados duplicados de manera inconsistente (p. ej., uno usa el primer valor, el otro usa el \u00faltimo), esto puede habilitar ataques de contrabando de solicitudes que conducen a la omisi\u00f3n de ACL, envenenamiento de cach\u00e9 o secuestro de credenciales"}], "id": "CVE-2026-1525", "lastModified": "2026-06-17T10:15:59.927", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1525", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-12T20:44:24.555703Z", "version": "2.0.3"}}]}, "published": "2026-03-12T20:16:02.670", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Vendor Advisory"], "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Technical Description"], "url": "https://cwe.mitre.org/data/definitions/444.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3556037"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Technical Description"], "url": "https://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{"bugzilla": {"description": "undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers", "id": "2447144", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447144"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-444", "details": ["A flaw was found in undici, a Node.js HTTP/1.1 client. A remote attacker could exploit this vulnerability by sending HTTP/1.1 requests that include duplicate Content-Length headers with different casing (e.g., \"Content-Length\" and \"content-length\"). This can lead to HTTP Request Smuggling, a technique where an attacker sends an ambiguous request that is interpreted differently by a proxy and a backend server. Successful exploitation could result in unauthorized access, cache poisoning, or credential hijacking. It may also cause a Denial of Service (DoS) if strict HTTP parsers reject the malformed requests."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-1525", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Fix deferred", "package_name": "io.cryostat-cryostat", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Fix deferred", "package_name": "openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Fix deferred", "package_name": "openshift-lightspeed/lightspeed-console-plugin-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Fix deferred", "package_name": "openshift-pipelines/pipelines-console-plugin-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Fix deferred", "package_name": "openshift-pipelines/pipelines-console-plugin-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "nodejs22", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "nodejs24", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "org.keycloak-keycloak-parent", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "org.keycloak-keycloak-parent", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-dashboard-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-sshd-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}], "public_date": "2026-03-12T19:56:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-1525\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-1525\nhttps://cna.openjsf.org/security-advisories.html\nhttps://cwe.mitre.org/data/definitions/444.html\nhttps://github.com/nodejs/undici/security/advisories/GHSA-2mjp-6q6p-2qxm\nhttps://hackerone.com/reports/3556037\nhttps://www.rfc-editor.org/rfc/rfc9110.html#section-8.6"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.24.0), [7.0.0,7.24.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.24.0,7.24.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "undici", "source": "cna", "vendor": "undici"}, "product": "undici", "vendor": "undici"}], "analysis": {"en": {"generated_at": "2026-03-19T18:27:46.564487+00:00", "value": {"mitigation_remediation": ["Validate header names and reject duplicate Content\u2011Length headers before passing them to undici.", "Pass headers as a plain object (e.g., { 'content-length': '123' }) rather than an array to automatically eliminate duplicate keys.", "Sanitize user\u2011controlled header input by normalizing header names to lowercase and rejecting any duplicates.", "Check for and install any undici updates that address this issue as they become released.", "Monitor undici security advisories and NVD for new patches or mitigations."], "summary": {"action": "Patch or Mitigate", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Affecting the Node.js HTTP client library undici (undici:undici). Applications that use undici.request(), undici.Client, or other low\u2011level APIs in which headers are supplied as arrays are impacted. Products that accept user\u2011controlled header names without first normalizing case and removing duplicates are also at risk. No specific affected versions are listed in the CNA data.", "description_and_impact": "Undici allows duplicate HTTP Content\u2011Length headers when headers are provided as a flat array with case\u2011variant names (e.g., Content\u2011Length and content-length). This creates malformed HTTP/1.1 requests with two conflicting Content\u2011Length values sent over the wire, enabling denial of service in strict parsers and opening the possibility for HTTP request smuggling. The weakness is a form of improper header validation and falls under CWE\u2011444.", "risk_and_exploitability": "The CVSS base score is 6.5 (moderate) and EPSS is less than 1%, indicating a relatively low likelihood of exploitation. The vulnerability is not in CISA\u2019s KEV catalog. Exploitability is inferred to require an attacker who can influence the headers sent to undici, such as through an application that forwards user input to the library without sanitization. If successfully leveraged, it can cause denial of service or enable request smuggling attacks such as ACL bypass, cache poisoning, or credential hijacking."}}}}, "created": "2026-03-13T09:49:56.281763+00:00", "updated": "2026-03-23T12:05:18.413301+00:00", "vendors": ["undici", "undici$PRODUCT$undici"]}