CVE-2026-2581

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2581", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-02-16T12:07:35.310Z", "datePublished": "2026-03-12T20:13:19.571Z", "dateUpdated": "2026-03-13T18:04:58.799Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-03-12T20:13:19.571Z"}, "title": "undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling", "type": "CWE"}]}], "affected": [{"vendor": "undici", "product": "undici", "collectionURL": "https://github.com/nodejs/undici/", "packageName": "undici", "repo": "https://github.com/nodejs/undici/", "versions": [{"status": "affected", "version": "< 6.24.0; 7.0.0 < 7.24.0"}, {"status": "unaffected", "version": "6.24.0: 7.24.0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).\n\nIn vulnerable Undici versions, when\u00a0interceptors.deduplicate()\u00a0is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.\n\nImpacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies.\n\nPatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.\n\nUsers should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).</p><p>In vulnerable Undici versions, when&nbsp;<code>interceptors.deduplicate()</code>&nbsp;is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.</p><p>Impacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies.</p><h2>Patches</h2><p>The issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.</p><p>Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.</p><p><br></p>"}]}], "references": [{"url": "https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h"}, {"url": "https://hackerone.com/reports/3513473"}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "credits": [{"lang": "en", "value": "Matteo Collina", "type": "remediation developer"}, {"lang": "en", "value": "Ulises Gasc\u00f3n", "type": "remediation reviewer"}, {"lang": "en", "value": "Adnan Jakati", "type": "finder"}], "source": {"advisory": "GHSA-phc3-fgpg-7m6h", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-13T18:04:49.981133Z", "id": "CVE-2026-2581", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T18:04:58.799Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2581", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-13T18:04:49.981133Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-13T18:04:54.993Z"}}], "cna": {"title": "undici is vulnerable to Unbounded Memory Consumption in in Undici's DeduplicationHandler via Response Buffering leads to DoS", "source": {"advisory": "GHSA-phc3-fgpg-7m6h", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "remediation developer", "value": "Matteo Collina"}, {"lang": "en", "type": "remediation reviewer", "value": "Ulises Gasc\u00f3n"}, {"lang": "en", "type": "finder", "value": "Adnan Jakati"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/nodejs/undici/", "vendor": "undici", "product": "undici", "versions": [{"status": "affected", "version": "< 6.24.0; 7.0.0 < 7.24.0"}, {"status": "unaffected", "version": "6.24.0: 7.24.0"}], "packageName": "undici", "collectionURL": "https://github.com/nodejs/undici/", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h"}, {"url": "https://hackerone.com/reports/3513473"}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "x_generator": {"engine": "Vulnogram 1.0.0"}, "descriptions": [{"lang": "en", "value": "This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).\n\nIn vulnerable Undici versions, when\u00a0interceptors.deduplicate()\u00a0is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.\n\nImpacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies.\n\nPatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.\n\nUsers should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.", "supportingMedia": [{"type": "text/html", "value": "<p>This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).</p><p>In vulnerable Undici versions, when&nbsp;<code>interceptors.deduplicate()</code>&nbsp;is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.</p><p>Impacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies.</p><h2>Patches</h2><p>The issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.</p><p>Users should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch.</p><p><br></p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770 Allocation of resources without limits or throttling"}]}], "providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-03-12T20:13:19.571Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2581", "state": "PUBLISHED", "dateUpdated": "2026-03-13T18:04:58.799Z", "dateReserved": "2026-02-16T12:07:35.310Z", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "datePublished": "2026-03-12T20:13:19.571Z", "assignerShortName": "openjs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/nodejs/undici/", "defaultStatus": "unaffected", "packageName": "undici", "product": "undici", "repo": "https://github.com/nodejs/undici/", "vendor": "undici", "versions": [{"status": "affected", "version": "< 6.24.0; 7.0.0 < 7.24.0"}, {"status": "unaffected", "version": "6.24.0: 7.24.0"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:undici:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F59DFD47-C8E0-425D-86EA-D9B0496EA2B6", "versionEndExcluding": "7.24.0", "versionStartIncluding": "7.17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This is an uncontrolled resource consumption vulnerability (CWE-400) that can lead to Denial of Service (DoS).\n\nIn vulnerable Undici versions, when\u00a0interceptors.deduplicate()\u00a0is enabled, response data for deduplicated requests could be accumulated in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large/chunked responses and concurrent identical requests, causing high memory usage and potential OOM process termination.\n\nImpacted users are applications that use Undici\u2019s deduplication interceptor against endpoints that may produce large or long-lived response bodies.\n\nPatchesThe issue has been patched by changing deduplication behavior to stream response chunks to downstream handlers as they arrive (instead of full-body accumulation), and by preventing late deduplication when body streaming has already started.\n\nUsers should upgrade to the first official Undici (and Node.js, where applicable) releases that include this patch."}, {"lang": "es", "value": "Esta es una vulnerabilidad de consumo de recursos no controlado (CWE-400) que puede conducir a una denegaci\u00f3n de servicio (DoS).\n\nEn versiones vulnerables de Undici, cuando interceptors.deduplicate() est\u00e1 habilitado, los datos de respuesta para solicitudes deduplicadas podr\u00edan acumularse en la memoria para los manejadores posteriores. Un endpoint ascendente controlado por un atacante o no confiable puede explotar esto con respuestas grandes/en fragmentos y solicitudes id\u00e9nticas concurrentes, causando un alto uso de memoria y una posible terminaci\u00f3n del proceso por OOM.\n\nLos usuarios afectados son aplicaciones que utilizan el interceptor de deduplicaci\u00f3n de Undici contra endpoints que pueden producir cuerpos de respuesta grandes o de larga duraci\u00f3n.\n\nParches. El problema ha sido parcheado cambiando el comportamiento de deduplicaci\u00f3n para transmitir fragmentos de respuesta a los manejadores posteriores a medida que llegan (en lugar de la acumulaci\u00f3n del cuerpo completo), y evitando la deduplicaci\u00f3n tard\u00eda cuando la transmisi\u00f3n del cuerpo ya ha comenzado.\n\nLos usuarios deber\u00edan actualizar a las primeras versiones oficiales de Undici (y Node.js, cuando corresponda) que incluyan este parche."}], "id": "CVE-2026-2581", "lastModified": "2026-06-17T10:31:21.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2581", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-13T18:04:49.981133Z", "version": "2.0.3"}}]}, "published": "2026-03-12T21:16:25.930", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Vendor Advisory"], "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/3513473"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{"bugzilla": {"description": "undici: Undici: Denial of Service due to uncontrolled resource consumption", "id": "2447140", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447140"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in Undici. When the `interceptors.deduplicate()` feature is enabled, response data for deduplicated requests can accumulate in memory. A remote attacker, by sending large or chunked responses and concurrent identical requests from an untrusted endpoint, can exploit this uncontrolled resource consumption. This leads to high memory usage and potential Out-Of-Memory (OOM) process termination, resulting in a Denial of Service (DoS) for the application."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-2581", "package_state": [{"cpe": "cpe:/a:redhat:cryostat:4", "fix_state": "Fix deferred", "package_name": "io.cryostat-cryostat", "product_name": "Cryostat 4"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Fix deferred", "package_name": "openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Fix deferred", "package_name": "openshift-lightspeed/lightspeed-console-plugin-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Fix deferred", "package_name": "openshift-pipelines/pipelines-console-plugin-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Fix deferred", "package_name": "openshift-pipelines/pipelines-console-plugin-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/a:redhat:rhdh:1", "fix_state": "Fix deferred", "package_name": "rhdh/rhdh-hub-rhel9", "product_name": "Red Hat Developer Hub"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "nodejs22", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "nodejs24", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:22/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "nodejs:24/nodejs", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "org.keycloak-keycloak-parent", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "org.keycloak-keycloak-parent", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-dashboard-rhel8", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/code-sshd-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Fix deferred", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:ansible_portal:2", "fix_state": "Fix deferred", "package_name": "ansible-automation-platform/automation-portal", "product_name": "Self-service automation portal 2"}], "public_date": "2026-03-12T20:13:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-2581\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-2581\nhttps://cna.openjsf.org/security-advisories.html\nhttps://github.com/nodejs/undici/security/advisories/GHSA-phc3-fgpg-7m6h\nhttps://hackerone.com/reports/3513473"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.24.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[7.0.0,7.24.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.24.0,7.24.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "undici", "source": "cna", "vendor": "undici"}, "product": "undici", "vendor": "undici"}], "analysis": {"en": {"generated_at": "2026-03-18T14:50:48.838770+00:00", "value": {"mitigation_remediation": ["Upgrade Undici to the first official release that includes the patch, which changes deduplication to stream response chunks and prevents late deduplication when streaming has started."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "Systems affected are Node.js applications that depend on the Undici package with its deduplication interceptor enabled. The vulnerability is present in older undici releases prior to the first official patched release. Exact version ranges are not specified in the advisory, but any installation of Undici that has the interceptor enabled and has not applied the patch is susceptible.", "description_and_impact": "Undici, the HTTP client library used by many Node.js applications, has a flaw that allows uncontrolled memory consumption when its deduplication interceptor is enabled. The vulnerability causes response data for identical requests to be buffered in memory rather than streamed to downstream handlers, resulting in unbounded growth in memory usage. If an attacker can control or influence a upstream endpoint to return large or chunked responses and multiple identical requests are sent concurrently, the process will exhaust available memory, potentially leading to an out\u2011of\u2011memory (OOM) error and a denial of service. The underlying weakness is identified as an unbounded unchecked resource consumption (CWE\u2011770, CWE\u2011400).", "risk_and_exploitability": "Risk assessment classifies the issue with a CVSS score of 5.9, indicating a medium severity. The EPSS score of less than 1% suggests that exploitation is currently uncommon or unlikely. The vulnerability is not listed in the CISA KEV catalog, implying it is not a known exploited vulnerability. Exploitation requires the application to receive large or chunked responses from an upstream service and simultaneously process several identical requests, meaning the exploitation vector is remote, likely over HTTP or HTTPS, and depends on the application\u2019s network exposure. While the conditions are specific, the impact on memory limits makes the exploit potentially effective for attackers who can trigger the conditions."}}}}, "created": "2026-03-13T09:49:51.840801+00:00", "updated": "2026-03-23T10:00:28.581828+00:00", "vendors": ["undici", "undici$PRODUCT$undici"]}