Skip to content
fr Sign in
7.5 High

CVE-2026-1526 The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during…

Description

The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive. The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.

Affected products and versions

Product Affected versions Fixed in
Cryostat 4 on RHEL 9 4.2 earliest → < 4.2.0-9 4.2.0-9
Red Hat Enterprise Linux AppStream EUS (v. 10.0) Versions not published
Red Hat Enterprise Linux AppStream (v. 10) Versions not published
Red Hat Enterprise Linux AppStream (v. 8) Versions not published
Red Hat Enterprise Linux AppStream EUS (v.9.6) Versions not published
Red Hat Enterprise Linux AppStream (v. 9) Versions not published
Red Hat Developer Hub 1.8 1776784286 earliest → < 1776784286 1776784286
Red Hat Developer Hub 1.9 1777903262 earliest → < 1777903262 1777903262
Red Hat OpenShift AI 2.16 1774282136 earliest → < 1774282136 1774282136
Show the 19 other branches
Product Affected versions Fixed in
Red Hat OpenShift Dev Spaces 3.28 1779814592 earliest → < 1779814592 1779814592
Red Hat OpenShift Pipelines 1.2 1779910201 earliest → < 1779910201 1779910201
OpenShift Lightspeed Versions not published
OpenShift Pipelines Versions not published
Red Hat Developer Hub Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Red Hat OpenShift Dev Spaces Versions not published
Self-service automation portal 2 Versions not published
Red Hat JBoss Enterprise Application Platform 8 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
undici Versions not published
Cluster Observability Operator 1.5.0 1782839996 earliest → < 1782839996 1782839996
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 10.0 Extended Update Support Versions not published
Red Hat Enterprise Linux 8 8100020260408131901.6 earliest → < 8100020260408131901.6d880403 8100020260408131901.6d880403
Red Hat Enterprise Linux 9 9070020260402152654 earliest → < 9070020260402152654.rhel9 9070020260402152654.rhel9
Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260409121057 earliest → < 9060020260409121057.rhel9 9060020260409121057.rhel9
Red Hat Openshift Data Foundation 4.18 1786706880 earliest → < 1786706880 1786706880
Cluster Observability Operator 1.5.2 1782839996 earliest → < 1782839996 1782839996

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Cryostat 4 on RHEL 9

The 54 CVEs of Cryostat 4 on RHEL 9 →
CVE-2026-54513 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor 8.1 High CVE-2026-50559 Quarkus is a Java framework for building cloud-native applications 7.5 High CVE-2026-9697 Impact: undici's ProxyAgent silently drops the requestTls option when configured with a SOCKS5 proxy URI (socks5:// or… 7.4 High CVE-2026-6734 Impact: When using Socks5ProxyAgent, undici reuses a single connection pool across different origins without verifying… 7.5 High
Track this CVE