CVE-2026-2229

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2229", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-02-08T17:51:16.985Z", "datePublished": "2026-03-12T20:27:05.600Z", "dateUpdated": "2026-09-14T12:04:29.461Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-03-12T20:27:05.600Z"}, "title": "undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-248", "description": "CWE-248 Uncaught exception", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-1284", "description": "CWE-1284 Improper validation of specified quantity in input", "type": "CWE"}]}], "affected": [{"vendor": "undici", "product": "undici", "collectionURL": "https://github.com/nodejs/undici/", "packageName": "undici", "repo": "https://github.com/nodejs/undici/", "versions": [{"status": "affected", "version": "< 6.24.0; 7.0.0 < 7.24.0"}, {"status": "unaffected", "version": "6.24.0: 7.24.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\u00a0server_max_window_bits\u00a0parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range\u00a0server_max_window_bits\u00a0value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.\n\nThe vulnerability exists because:\n\n * The\u00a0isValidClientWindowBits()\u00a0function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15\n * The\u00a0createInflateRaw()\u00a0call is not wrapped in a try-catch block\n * The resulting exception propagates up through the call stack and crashes the Node.js process", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<h3><span>Impact</span></h3><p>The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the&nbsp;<code>server_max_window_bits</code>&nbsp;parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range&nbsp;<code>server_max_window_bits</code>&nbsp;value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.</p><p>The vulnerability exists because:</p><ol><li>The&nbsp;<code>isValidClientWindowBits()</code>&nbsp;function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15</li><li>The&nbsp;<code>createInflateRaw()</code>&nbsp;call is not wrapped in a try-catch block</li><li>The resulting exception propagates up through the call stack and crashes the Node.js process</li></ol><br>"}]}], "references": [{"url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"}, {"url": "https://hackerone.com/reports/3487486"}, {"url": "https://cna.openjsf.org/security-advisories.html"}, {"url": "https://datatracker.ietf.org/doc/html/rfc7692"}, {"url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "credits": [{"lang": "en", "value": "Matteo Collina", "type": "remediation developer"}, {"lang": "en", "value": "Ulises Gasc\u00f3n", "type": "remediation reviewer"}, {"lang": "en", "value": "Rafael Gonzaga", "type": "remediation reviewer"}, {"lang": "en", "value": "Ethan Arrowood", "type": "remediation reviewer"}, {"lang": "en", "value": "Aisle Research", "type": "reporter"}], "source": {"advisory": "GHSA-v9p9-hfj2-hcw8", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T13:06:30.575811Z", "id": "CVE-2026-2229", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T13:06:46.814Z"}}, {"affected": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cryostat:4::el9"], "defaultStatus": "affected", "packageName": "cryostat/cryostat-openshift-console-plugin-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.2.0-9", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cryostat:4::el9"], "defaultStatus": "affected", "packageName": "cryostat/cryostat-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.2.0-9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "nodejs22", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1:22.22.2-1.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "nodejs24", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1:24.14.1-2.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "nodejs22", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1:22.22.2-2.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "nodejs:22", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260331102257.6d880403", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "nodejs:24", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260408131901.6d880403", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "nodejs:22", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9070020260401095228.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "nodejs:24", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9070020260402152654.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "nodejs:22", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9060020260409121057.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "defaultStatus": "affected", "packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782839279", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "defaultStatus": "affected", "packageName": "cluster-observability-operator/logging-console-plugin-pf5-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782840539", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "defaultStatus": "affected", "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782839996", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhdh:1.8::el9"], "defaultStatus": "affected", "packageName": "rhdh/rhdh-hub-rhel9", "product": "Red Hat Developer Hub 1.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1776784286", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhdh:1.9::el9"], "defaultStatus": "affected", "packageName": "rhdh/rhdh-hub-rhel9", "product": "Red Hat Developer Hub 1.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1777903262", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.16::el8"], "defaultStatus": "affected", "packageName": "rhoai/odh-dashboard-rhel8", "product": "Red Hat OpenShift AI 2.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1774282136", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/cephcsi-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705347", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/cephcsi-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706101", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/mcg-core-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705558", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/mcg-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705646", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/ocs-client-console-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706138", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/ocs-client-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705741", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/ocs-metrics-exporter-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705777", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/ocs-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705802", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-cli-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705938", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-console-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706577", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-cosi-sidecar-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706125", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-csi-addons-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706177", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-csi-addons-sidecar-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706188", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-multicluster-console-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706679", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-multicluster-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706357", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-must-gather-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706612", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706644", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odr-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706659", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/rook-ceph-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706880", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3.28::el9"], "defaultStatus": "affected", "packageName": "devspaces/code-rhel9", "product": "Red Hat OpenShift Dev Spaces 3.28", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779814592", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1.20::el9"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-console-plugin-rhel9", "product": "Red Hat OpenShift Pipelines 1.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779910201", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_lightspeed"], "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9", "product": "OpenShift Lightspeed", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_lightspeed"], "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-console-plugin-rhel9", "product": "OpenShift Lightspeed", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-console-plugin-rhel8", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhdh:1"], "defaultStatus": "affected", "packageName": "rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor", "product": "Red Hat Developer Hub", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"], "defaultStatus": "unaffected", "packageName": "org.keycloak-keycloak-parent", "product": "Red Hat JBoss Enterprise Application Platform 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "unaffected", "packageName": "org.keycloak-keycloak-parent", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "unaffected", "packageName": "devspaces/code-sshd-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "unaffected", "packageName": "devspaces/openvsx-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_portal:2"], "defaultStatus": "affected", "packageName": "ansible-automation-platform/automation-portal", "product": "Self-service automation portal 2", "vendor": "Red Hat"}], "datePublic": "2026-03-12T20:27:05.600Z", "descriptions": [{"lang": "en", "value": "A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client's Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-248", "description": "Uncaught Exception", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-2229"}, {"name": "RHBZ#2447143", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2229.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:17789"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:7310"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:7080"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:7675"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:7123"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:7670"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:7983"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:7302"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:7350"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:34342"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:9742"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:13826"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:5807"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:21772"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:21931"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:56431"}], "solutions": [{"lang": "en", "value": "RHSA-2026:17789: Cryostat 4 on RHEL 9"}, {"lang": "en", "value": "RHSA-2026:7310: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:7080: Red Hat Enterprise Linux AppStream (v. 10)"}, {"lang": "en", "value": "RHSA-2026:7675: Red Hat Enterprise Linux AppStream (v. 10)"}, {"lang": "en", "value": "RHSA-2026:7123: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:7670: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:7983: Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:7302: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:7350: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:34342: Cluster Observability Operator 1.5.0"}, {"lang": "en", "value": "RHSA-2026:9742: Red Hat Developer Hub 1.8"}, {"lang": "en", "value": "RHSA-2026:13826: Red Hat Developer Hub 1.9"}, {"lang": "en", "value": "RHSA-2026:5807: Red Hat OpenShift AI 2.16"}, {"lang": "en", "value": "RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28"}, {"lang": "en", "value": "RHSA-2026:21931: Red Hat OpenShift Pipelines 1.2"}, {"lang": "en", "value": "RHSA-2026:56431: Red Hat Openshift Data Foundation 4.18"}], "timeline": [{"lang": "en", "time": "2026-03-12T21:01:29.187Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-12T20:27:05.600Z", "value": "Made public."}], "title": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-14T12:04:29.461Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"cpes": ["cpe:/a:redhat:cryostat:4::el9"], "vendor": "Red Hat", "product": "Cryostat 4 on RHEL 9", "versions": [{"status": "unaffected", "version": "4.2.0-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "cryostat/cryostat-openshift-console-plugin-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cryostat:4::el9"], "vendor": "Red Hat", "product": "Cryostat 4 on RHEL 9", "versions": [{"status": "unaffected", "version": "4.2.0-9", "lessThan": "*", "versionType": "rpm"}], "packageName": "cryostat/cryostat-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "1:22.22.2-1.el10_1", "lessThan": "*", "versionType": "rpm"}], "packageName": "nodejs22", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "versions": [{"status": "unaffected", "version": "1:24.14.1-2.el10_1", "lessThan": "*", "versionType": "rpm"}], "packageName": "nodejs24", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "versions": [{"status": "unaffected", "version": "1:22.22.2-2.el10_0", "lessThan": "*", "versionType": "rpm"}], "packageName": "nodejs22", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "8100020260331102257.6d880403", "lessThan": "*", "versionType": "rpm"}], "packageName": "nodejs:22", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "versions": [{"status": "unaffected", "version": "8100020260408131901.6d880403", "lessThan": "*", "versionType": "rpm"}], "packageName": "nodejs:24", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "9070020260401095228.rhel9", "lessThan": "*", "versionType": "rpm"}], "packageName": "nodejs:22", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "versions": [{"status": "unaffected", "version": "9070020260402152654.rhel9", "lessThan": "*", "versionType": "rpm"}], "packageName": "nodejs:24", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "versions": [{"status": "unaffected", "version": "9060020260409121057.rhel9", "lessThan": "*", "versionType": "rpm"}], "packageName": "nodejs:22", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "vendor": "Red Hat", "product": "Cluster Observability Operator 1.5.0", "versions": [{"status": "unaffected", "version": "1782839279", "lessThan": "*", "versionType": "rpm"}], "packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "vendor": "Red Hat", "product": "Cluster Observability Operator 1.5.0", "versions": [{"status": "unaffected", "version": "1782840539", "lessThan": "*", "versionType": "rpm"}], "packageName": "cluster-observability-operator/logging-console-plugin-pf5-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "vendor": "Red Hat", "product": "Cluster Observability Operator 1.5.0", "versions": [{"status": "unaffected", "version": "1782839996", "lessThan": "*", "versionType": "rpm"}], "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhdh:1.8::el9"], "vendor": "Red Hat", "product": "Red Hat Developer Hub 1.8", "versions": [{"status": "unaffected", "version": "1776784286", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhdh/rhdh-hub-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhdh:1.9::el9"], "vendor": "Red Hat", "product": "Red Hat Developer Hub 1.9", "versions": [{"status": "unaffected", "version": "1777903262", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhdh/rhdh-hub-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:2.16::el8"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 2.16", "versions": [{"status": "unaffected", "version": "1774282136", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-dashboard-rhel8", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786705347", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/cephcsi-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706101", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/cephcsi-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786705558", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/mcg-core-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786705646", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/mcg-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706138", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/ocs-client-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786705741", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/ocs-client-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786705777", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/ocs-metrics-exporter-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786705802", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/ocs-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786705938", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/odf-cli-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706577", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/odf-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706125", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/odf-cosi-sidecar-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706177", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/odf-csi-addons-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706188", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/odf-csi-addons-sidecar-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706679", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/odf-multicluster-console-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706357", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/odf-multicluster-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706612", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/odf-must-gather-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706644", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/odf-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706659", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/odr-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "vendor": "Red Hat", "product": "Red Hat Openshift Data Foundation 4.18", "versions": [{"status": "unaffected", "version": "1786706880", "lessThan": "*", "versionType": "rpm"}], "packageName": "odf4/rook-ceph-rhel9-operator", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3.28::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces 3.28", "versions": [{"status": "unaffected", "version": "1779814592", "lessThan": "*", "versionType": "rpm"}], "packageName": "devspaces/code-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1.20::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift Pipelines 1.2", "versions": [{"status": "unaffected", "version": "1779910201", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-pipelines/pipelines-console-plugin-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_lightspeed"], "vendor": "Red Hat", "product": "OpenShift Lightspeed", "packageName": "openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_lightspeed"], "vendor": "Red Hat", "product": "OpenShift Lightspeed", "packageName": "openshift-lightspeed/lightspeed-console-plugin-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "vendor": "Red Hat", "product": "OpenShift Pipelines", "packageName": "openshift-pipelines/pipelines-console-plugin-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:rhdh:1"], "vendor": "Red Hat", "product": "Red Hat Developer Hub", "packageName": "rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "packageName": "org.keycloak-keycloak-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "org.keycloak-keycloak-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces", "packageName": "devspaces/code-sshd-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "vendor": "Red Hat", "product": "Red Hat OpenShift Dev Spaces", "packageName": "devspaces/openvsx-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:ansible_portal:2"], "vendor": "Red Hat", "product": "Self-service automation portal 2", "packageName": "ansible-automation-platform/automation-portal", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2026-03-12T21:01:29.187Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-12T20:27:05.600Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:17789: Cryostat 4 on RHEL 9"}, {"lang": "en", "value": "RHSA-2026:7310: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:7080: Red Hat Enterprise Linux AppStream (v. 10)"}, {"lang": "en", "value": "RHSA-2026:7675: Red Hat Enterprise Linux AppStream (v. 10)"}, {"lang": "en", "value": "RHSA-2026:7123: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:7670: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:7983: Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:7302: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:7350: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:34342: Cluster Observability Operator 1.5.0"}, {"lang": "en", "value": "RHSA-2026:9742: Red Hat Developer Hub 1.8"}, {"lang": "en", "value": "RHSA-2026:13826: Red Hat Developer Hub 1.9"}, {"lang": "en", "value": "RHSA-2026:5807: Red Hat OpenShift AI 2.16"}, {"lang": "en", "value": "RHSA-2026:21772: Red Hat OpenShift Dev Spaces 3.28"}, {"lang": "en", "value": "RHSA-2026:21931: Red Hat OpenShift Pipelines 1.2"}, {"lang": "en", "value": "RHSA-2026:56431: Red Hat Openshift Data Foundation 4.18"}], "x_adpType": "supplier", "datePublic": "2026-03-12T20:27:05.600Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-2229", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143", "name": "RHBZ#2447143", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2229.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:17789", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7310", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7080", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7675", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7123", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7670", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7983", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7302", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:7350", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:34342", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:9742", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:13826", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:5807", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:21772", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:21931", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:56431", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client's Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "Uncaught Exception"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-14T12:04:29.461Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2229", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T13:06:30.575811Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T13:06:41.726Z"}}], "cna": {"title": "undici is vulnerable to Unhandled Exception in undici WebSocket Client Due to Invalid server_max_window_bits Validation", "source": {"advisory": "GHSA-v9p9-hfj2-hcw8", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "remediation developer", "value": "Matteo Collina"}, {"lang": "en", "type": "remediation reviewer", "value": "Ulises Gasc\u00f3n"}, {"lang": "en", "type": "remediation reviewer", "value": "Rafael Gonzaga"}, {"lang": "en", "type": "remediation reviewer", "value": "Ethan Arrowood"}, {"lang": "en", "type": "reporter", "value": "Aisle Research"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/nodejs/undici/", "vendor": "undici", "product": "undici", "versions": [{"status": "affected", "version": "< 6.24.0; 7.0.0 < 7.24.0"}, {"status": "unaffected", "version": "6.24.0: 7.24.0"}], "packageName": "undici", "collectionURL": "https://github.com/nodejs/undici/", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"}, {"url": "https://hackerone.com/reports/3487486"}, {"url": "https://cna.openjsf.org/security-advisories.html"}, {"url": "https://datatracker.ietf.org/doc/html/rfc7692"}, {"url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\u00a0server_max_window_bits\u00a0parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range\u00a0server_max_window_bits\u00a0value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.\n\nThe vulnerability exists because:\n\n * The\u00a0isValidClientWindowBits()\u00a0function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15\n * The\u00a0createInflateRaw()\u00a0call is not wrapped in a try-catch block\n * The resulting exception propagates up through the call stack and crashes the Node.js process", "supportingMedia": [{"type": "text/html", "value": "<h3><span>Impact</span></h3><p>The undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the&nbsp;<code>server_max_window_bits</code>&nbsp;parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range&nbsp;<code>server_max_window_bits</code>&nbsp;value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.</p><p>The vulnerability exists because:</p><ol><li>The&nbsp;<code>isValidClientWindowBits()</code>&nbsp;function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15</li><li>The&nbsp;<code>createInflateRaw()</code>&nbsp;call is not wrapped in a try-catch block</li><li>The resulting exception propagates up through the call stack and crashes the Node.js process</li></ol><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-248", "description": "CWE-248 Uncaught exception"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1284", "description": "CWE-1284 Improper validation of specified quantity in input"}]}], "providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-03-12T20:27:05.600Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2229", "state": "PUBLISHED", "dateUpdated": "2026-09-14T12:04:29.461Z", "dateReserved": "2026-02-08T17:51:16.985Z", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "datePublished": "2026-03-12T20:27:05.600Z", "assignerShortName": "openjs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/nodejs/undici/", "defaultStatus": "unaffected", "packageName": "undici", "product": "undici", "repo": "https://github.com/nodejs/undici/", "vendor": "undici", "versions": [{"status": "affected", "version": "< 6.24.0; 7.0.0 < 7.24.0"}, {"status": "unaffected", "version": "6.24.0: 7.24.0"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"affectedData": [{"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cryostat:4::el9"], "defaultStatus": "affected", "packageName": "cryostat/cryostat-openshift-console-plugin-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.2.0-9", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cryostat:4::el9"], "defaultStatus": "affected", "packageName": "cryostat/cryostat-rhel9", "product": "Cryostat 4 on RHEL 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "4.2.0-9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "nodejs22", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1:22.22.2-1.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1"], "defaultStatus": "affected", "packageName": "nodejs24", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1:24.14.1-2.el10_1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "nodejs22", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1:22.22.2-2.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "nodejs:22", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260331102257.6d880403", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "nodejs:24", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260408131901.6d880403", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "nodejs:22", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9070020260401095228.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "nodejs:24", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9070020260402152654.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "nodejs:22", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9060020260409121057.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "defaultStatus": "affected", "packageName": "cluster-observability-operator/logging-console-plugin-pf4-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782839279", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "defaultStatus": "affected", "packageName": "cluster-observability-operator/logging-console-plugin-pf5-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782840539", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:cluster_observability_operator:1.5::el9"], "defaultStatus": "affected", "packageName": "cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9", "product": "Cluster Observability Operator 1.5.0", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1782839996", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhdh:1.8::el9"], "defaultStatus": "affected", "packageName": "rhdh/rhdh-hub-rhel9", "product": "Red Hat Developer Hub 1.8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1776784286", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhdh:1.9::el9"], "defaultStatus": "affected", "packageName": "rhdh/rhdh-hub-rhel9", "product": "Red Hat Developer Hub 1.9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1777903262", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:2.16::el8"], "defaultStatus": "affected", "packageName": "rhoai/odh-dashboard-rhel8", "product": "Red Hat OpenShift AI 2.16", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1774282136", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/cephcsi-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705347", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/cephcsi-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706101", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/mcg-core-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705558", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/mcg-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705646", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/ocs-client-console-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706138", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/ocs-client-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705741", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/ocs-metrics-exporter-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705777", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/ocs-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705802", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-cli-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786705938", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-console-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706577", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-cosi-sidecar-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706125", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-csi-addons-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706177", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-csi-addons-sidecar-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706188", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-multicluster-console-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706679", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-multicluster-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706357", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-must-gather-rhel9", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706612", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odf-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706644", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/odr-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706659", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_data_foundation:4.18::el9"], "defaultStatus": "affected", "packageName": "odf4/rook-ceph-rhel9-operator", "product": "Red Hat Openshift Data Foundation 4.18", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1786706880", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3.28::el9"], "defaultStatus": "affected", "packageName": "devspaces/code-rhel9", "product": "Red Hat OpenShift Dev Spaces 3.28", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779814592", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1.20::el9"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-console-plugin-rhel9", "product": "Red Hat OpenShift Pipelines 1.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1779910201", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_lightspeed"], "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9", "product": "OpenShift Lightspeed", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_lightspeed"], "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-console-plugin-rhel9", "product": "OpenShift Lightspeed", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_pipelines:1"], "defaultStatus": "affected", "packageName": "openshift-pipelines/pipelines-console-plugin-rhel8", "product": "OpenShift Pipelines", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhdh:1"], "defaultStatus": "affected", "packageName": "rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor", "product": "Red Hat Developer Hub", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"], "defaultStatus": "unaffected", "packageName": "org.keycloak-keycloak-parent", "product": "Red Hat JBoss Enterprise Application Platform 8", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:jbosseapxp"], "defaultStatus": "unaffected", "packageName": "org.keycloak-keycloak-parent", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "affected", "packageName": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "unaffected", "packageName": "devspaces/code-sshd-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_devspaces:3"], "defaultStatus": "unaffected", "packageName": "devspaces/openvsx-rhel9", "product": "Red Hat OpenShift Dev Spaces", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_portal:2"], "defaultStatus": "affected", "packageName": "ansible-automation-platform/automation-portal", "product": "Self-service automation portal 2", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "C08CE582-019D-4A06-910A-6010C2D6EF4F", "versionEndExcluding": "6.24.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F016E7D9-C45A-4DEF-9AD8-F0581AF5E509", "versionEndExcluding": "7.24.0", "versionStartIncluding": "7.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the\u00a0server_max_window_bits\u00a0parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range\u00a0server_max_window_bits\u00a0value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.\n\nThe vulnerability exists because:\n\n * The\u00a0isValidClientWindowBits()\u00a0function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15\n * The\u00a0createInflateRaw()\u00a0call is not wrapped in a try-catch block\n * The resulting exception propagates up through the call stack and crashes the Node.js process"}, {"lang": "es", "value": "Impacto\nEl cliente WebSocket undici es vulnerable a un ataque de denegaci\u00f3n de servicio debido a la validaci\u00f3n incorrecta del par\u00e1metro server_max_window_bits en la extensi\u00f3n permessage-deflate. Cuando un cliente WebSocket se conecta a un servidor, anuncia autom\u00e1ticamente soporte para la compresi\u00f3n permessage-deflate. Un servidor malicioso puede responder con un valor server_max_window_bits fuera de rango (fuera del rango v\u00e1lido de zlib de 8-15). Cuando el servidor env\u00eda posteriormente un frame comprimido, el cliente intenta crear una instancia zlib InflateRaw con el valor windowBits no v\u00e1lido, causando una excepci\u00f3n RangeError s\u00edncrona que no es capturada, lo que resulta en la terminaci\u00f3n inmediata del proceso.\n\nLa vulnerabilidad existe porque:\n\n * La funci\u00f3n isValidClientWindowBits() solo valida que el valor contiene d\u00edgitos ASCII, no que caiga dentro del rango v\u00e1lido 8-15\n * La llamada a createInflateRaw() no est\u00e1 envuelta en un bloque try-catch\n * La excepci\u00f3n resultante se propaga a trav\u00e9s de la pila de llamadas y bloquea el proceso de Node.js"}], "id": "CVE-2026-2229", "lastModified": "2026-09-04T13:18:41.890", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2229", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T13:06:30.575811Z", "version": "2.0.3"}}]}, "published": "2026-03-12T21:16:25.573", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Vendor Advisory"], "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Technical Description"], "url": "https://datatracker.ietf.org/doc/html/rfc7692"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Vendor Advisory"], "url": "https://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3487486"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Technical Description"], "url": "https://nodejs.org/api/zlib.html#class-zlibinflateraw"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:13826"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:17789"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:21772"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:21931"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:34342"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:56431"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:5807"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:7080"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:7123"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:7302"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:7310"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:7350"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:7670"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:7675"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:7983"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:9742"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-2229"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2229.json"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-248"}, {"lang": "en", "value": "CWE-1284"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-248"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter", "id": "2447143", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447143"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-248", "details": ["A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client's Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-2229", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Affected", "package_name": "io.cryostat-cryostat", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Affected", "package_name": "openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Affected", "package_name": "openshift-lightspeed/lightspeed-console-plugin-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-console-plugin-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-console-plugin-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Affected", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "nodejs22", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "nodejs24", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Affected", "package_name": "org.keycloak-keycloak-parent", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "org.keycloak-keycloak-parent", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-dashboard-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/code-sshd-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Affected", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Affected", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}], "public_date": "2026-03-12T20:27:05Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-2229\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-2229\nhttps://cna.openjsf.org/security-advisories.html\nhttps://datatracker.ietf.org/doc/html/rfc7692\nhttps://github.com/nodejs/undici/security/advisories/GHSA-v9p9-hfj2-hcw8\nhttps://hackerone.com/reports/3487486\nhttps://nodejs.org/api/zlib.html#class-zlibinflateraw"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.24.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.24.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.24.0,7.24.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "undici", "source": "cna", "vendor": "undici"}, "product": "undici", "vendor": "undici"}], "analysis": {"en": {"generated_at": "2026-03-20T16:30:09.516949+00:00", "value": {"mitigation_remediation": ["Update the undici library to the latest release that includes validation for server_max_window_bits", "Verify that the Node.js application no longer crashes when interacting with external WebSocket servers", "Apply the patch before the next code deployment and monitor the application health for any unexpected crashes"], "summary": {"action": "Patch Now", "impact": "Denial of Service via unhandled exception in undici WebSocket client"}, "threat_synthesis": {"affected_systems": "The undici library, which is the HTTP client used by many Node.js applications, is affected. No specific version range is listed in the advisory, so any version of undici that has not been updated to validate the server_max_window_bits parameter correctly is vulnerable. Users of undici in Node.js projects should assume the risk applies until a patch is applied.", "description_and_impact": "The vulnerability arises when a WebSocket server replies with an invalid server_max_window_bits value outside the zlib\u2011defined range (8\u201315). The undici client attempts to create a zlib InflateRaw instance with this out\u2011of\u2011range value, causing a synchronous RangeError that is not caught. The exception propagates and terminates the Node.js process, resulting in a denial\u2011of\u2011service condition for any application that relies on that client. This bug is a fault in input validation (CWE-1284) that leads to an unhandled exception (CWE-248).", "risk_and_exploitability": "The CVSS score of 7.5 classifies the bug as high severity. The EPSS score of less than 1% indicates a low predicted exploitation probability at present, and the vulnerability is not listed in the CISA KEV catalog. However, the attack vector is remote: an attacker who controls a WebSocket server can send the crafted extension during the handshake. This requires no special privilege on the client side, so the vulnerability can be exploited from anywhere the client connects to such a server. Given the straightforward exploitation path and the severity, the risk is elevated for exposed services that rely on undici."}}}}, "created": "2026-03-13T09:49:47.519472+00:00", "updated": "2026-03-23T10:00:24.598937+00:00", "vendors": ["undici", "undici$PRODUCT$undici"]}