CVE-2026-12151 Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but…
Description
Impact: The undici WebSocket client enforces maxPayloadSize on the cumulative byte count of fragments in a message but does not enforce a limit on the number of fragments. A malicious WebSocket server can stream many small or empty continuation frames that each pass per-frame and cumulative-size validation, collectively causing unbounded memory growth in the client process. The result is memory exhaustion and a denial of service. Affected applications are those using the undici WebSocket client (new WebSocket(...)) or the WebSocketStream API that can be induced to connect to an attacker-controlled or compromised WebSocket endpoint. All releases starting at undici 6.17.0 are affected. Patches: Upgrade to undici >= 6.26.0, >= 7.28.0, or >= 8.5.0. Workarounds: No workaround is available. The fix must be applied through an upgrade.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| undici 8.5 | premières → < 8.5.0 | 8.5.0 |
| undici 8.0 | 8.0.0 → < 8.5.0 | 8.5.0 |
| undici 7.28 | premières → < 7.28.0 | 7.28.0 |
| undici 7.0 | 7.0.0 → < 7.28.0 | 7.28.0 |
| undici 6.26 | premières → < 6.26.0 | 6.26.0 |
| Cryostat 4 | Versions non publiées | |
| OpenShift Pipelines | Versions non publiées | |
| Red Hat AMQ Broker 7 | Versions non publiées | |
| Red Hat Build of Podman Desktop | Versions non publiées |
Afficher les 31 autres branches Masquer les 31 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Developer Hub | Versions non publiées | |
| Red Hat Enterprise Linux 10 | Versions non publiées | |
| Red Hat Enterprise Linux 8 8100020260703140402.6 | premières → < 8100020260703140402.6d880403 | 8100020260703140402.6d880403 |
| Red Hat Enterprise Linux 9 9080020260626075442 | premières → < 9080020260626075442.rhel9 | 9080020260626075442.rhel9 |
| Red Hat Hardened Images | Versions non publiées | |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées | |
| Red Hat OpenShift Container Platform 4 | Versions non publiées | |
| Red Hat Openshift Data Foundation 4 | Versions non publiées | |
| Red Hat OpenShift Dev Spaces | Versions non publiées | |
| Self-service automation portal 2 | Versions non publiées | |
| Cluster Observability Operator 1.5.0 1782839494 | premières → < 1782839494 | 1782839494 |
| Red Hat Enterprise Linux AppStream (v. 10) | Versions non publiées | |
| Red Hat Enterprise Linux AppStream (v. 9) | Versions non publiées | |
| Red Hat Developer Hub 1.10 1783448184 | premières → < 1783448184 | 1783448184 |
| Red Hat OpenShift Dev Spaces 3.29 1785245777 | premières → < 1785245777 | 1785245777 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions non publiées | |
| Red Hat OpenShift Container Platform 4.16 1783306396 | premières → < 1783306396 | 1783306396 |
| Red Hat Developer Hub 1.9 1784210921 | premières → < 1784210921 | 1784210921 |
| Cryostat 4 on RHEL 9 4.2 | premières → < 4.2.0-13 | 4.2.0-13 |
| Red Hat OpenShift Container Platform 4.17 1784744859 | premières → < 1784744859 | 1784744859 |
| Red Hat Enterprise Linux 9.6 Extended Update Support 9060020260804140259 | premières → < 9060020260804140259.rhel9 | 9060020260804140259.rhel9 |
| Red Hat OpenShift AI 3.4 1787121387 | premières → < 1787121387 | 1787121387 |
| Red Hat Openshift Data Foundation 4.18 1786706880 | premières → < 1786706880 | 1786706880 |
| Red Hat Openshift Data Foundation 4.19 1786703143 | premières → < 1786703143 | 1786703143 |
| Red Hat Openshift Data Foundation 4.2 1786629548 | premières → < 1786629548 | 1786629548 |
| Cluster Observability Operator 1.5.2 1782839494 | premières → < 1782839494 | 1782839494 |
| Red Hat OpenShift Dev Spaces 3.30 1787759723 | premières → < 1787759723 | 1787759723 |
| Red Hat OpenShift AI 2.25 1787801527 | premières → < 1787801527 | 1787801527 |
| Red Hat Openshift Data Foundation 4.20 1786629548 | premières → < 1786629548 | 1786629548 |
| Red Hat AMQ Broker 7.13.6 | Versions non publiées | |
| Red Hat AMQ Broker 7.14.1 | Versions non publiées |
Références
- github.com github.com
- cna.openjsf.org cna.openjsf.org
Chronologie
- Publiée
- Dernière modification