{"metadata": {"vulnerability": "CVE-2026-18149", "count": 124, "kinds": {"milestone": 24, "sighting": 3, "kev": 0, "other": 97}}, "data": [{"timestamp": "2026-07-07T21:08:04.579Z", "date_only": false, "value": "2026-07-07T21:08:04.579000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-07-07T22:01:47.475Z", "date_only": false, "value": "2026-07-07T22:01:47.475071+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-07-23T12:54:23.124Z", "date_only": false, "value": "2026-07-23T12:54:23.124000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-07-23T14:01:26.376Z", "date_only": false, "value": "2026-07-23T14:01:26.376839+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-07-28T19:16:37.429Z", "date_only": false, "value": "2026-07-28T19:16:37.429Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-18149", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-03T16:33:36.324Z", "date_only": false, "value": "2026-08-03T16:33:36.324000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-08-03T18:01:13.566Z", "date_only": false, "value": "2026-08-03T18:01:13.566423+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-08-12T14:18:37Z", "date_only": false, "value": "2026-08-12T14:18:37+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-08-12T14:18:37Z", "date_only": false, "value": "2026-08-12T14:18:37+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-08-12T14:18:37Z", "date_only": false, "value": "2026-08-12T14:18:37+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-08-12T21:03:47Z", "date_only": false, "value": "2026-08-12T21:03:47+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-08-12T21:03:47Z", "date_only": false, "value": "2026-08-12T21:03:47+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-08-12T21:03:47Z", "date_only": false, "value": "2026-08-12T21:03:47+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-08-20T00:00:00Z", "date_only": false, "value": "2026-08-20T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-09-02T00:00:00Z", "date_only": false, "value": "2026-09-02T00:00:00+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-09-04T16:30:07.996Z", "date_only": false, "value": "2026-09-04T16:30:07.996000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-09-04T16:30:07.996Z", "date_only": false, "value": "2026-09-04T16:30:07.996000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-09-04T16:30:07.996Z", "date_only": false, "value": "2026-09-04T16:30:07.996000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.10.release_date"}, {"timestamp": "2026-09-04T16:36:28.085Z", "date_only": false, "value": "2026-09-04T16:36:28.085000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.8.release_date"}, {"timestamp": "2026-09-04T16:36:28.085Z", "date_only": false, "value": "2026-09-04T16:36:28.085000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-09-04T16:41:09.987Z", "date_only": false, "value": "2026-09-04T16:41:09.987760+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-09-04T16:41:09.987Z", "date_only": false, "value": "2026-09-04T16:41:09.987760+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-09-04T16:41:09.987Z", "date_only": false, "value": "2026-09-04T16:41:09.987760+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.10.discovery_date"}, {"timestamp": "2026-09-04T16:41:35.623Z", "date_only": false, "value": "2026-09-04T16:41:35.623977+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.8.discovery_date"}, {"timestamp": "2026-09-04T16:41:35.623Z", "date_only": false, "value": "2026-09-04T16:41:35.623977+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-09-04T16:42:40.780Z", "date_only": false, "value": "2026-09-04T16:42:40.780000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-09-04T16:42:40.780Z", "date_only": false, "value": "2026-09-04T16:42:40.780000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-09-04T16:42:40.780Z", "date_only": false, "value": "2026-09-04T16:42:40.780000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.9.release_date"}, {"timestamp": "2026-09-04T16:47:55.724Z", "date_only": false, "value": "2026-09-04T16:47:55.724000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-09-04T16:47:55.724Z", "date_only": false, "value": "2026-09-04T16:47:55.724000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.8.release_date"}, {"timestamp": "2026-09-04T16:52:40.440Z", "date_only": false, "value": "2026-09-04T16:52:40.440125+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-09-04T16:52:40.440Z", "date_only": false, "value": "2026-09-04T16:52:40.440125+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.8.discovery_date"}, {"timestamp": "2026-09-04T16:53:11.716Z", "date_only": false, "value": "2026-09-04T16:53:11.716000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-09-04T16:53:11.716Z", "date_only": false, "value": "2026-09-04T16:53:11.716000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-09-04T16:53:11.716Z", "date_only": false, "value": "2026-09-04T16:53:11.716000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.7.release_date"}, {"timestamp": "2026-09-04T16:55:29.468Z", "date_only": false, "value": "2026-09-04T16:55:29.468757+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-09-04T16:55:29.468Z", "date_only": false, "value": "2026-09-04T16:55:29.468757+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-09-04T16:55:29.468Z", "date_only": false, "value": "2026-09-04T16:55:29.468757+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.9.discovery_date"}, {"timestamp": "2026-09-04T16:59:08.807Z", "date_only": false, "value": "2026-09-04T16:59:08.807000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.4.release_date"}, {"timestamp": "2026-09-04T16:59:08.807Z", "date_only": false, "value": "2026-09-04T16:59:08.807000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-09-04T16:59:08.807Z", "date_only": false, "value": "2026-09-04T16:59:08.807000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.6.release_date"}, {"timestamp": "2026-09-04T17:01:36.613Z", "date_only": false, "value": "2026-09-04T17:01:36.613728+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-09-04T17:01:36.613Z", "date_only": false, "value": "2026-09-04T17:01:36.613728+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-09-04T17:01:36.613Z", "date_only": false, "value": "2026-09-04T17:01:36.613728+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.7.discovery_date"}, {"timestamp": "2026-09-04T17:04:28.261Z", "date_only": false, "value": "2026-09-04T17:04:28.261000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-09-04T17:04:28.261Z", "date_only": false, "value": "2026-09-04T17:04:28.261000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-09-04T17:04:28.261Z", "date_only": false, "value": "2026-09-04T17:04:28.261000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.5.release_date"}, {"timestamp": "2026-09-04T17:10:05.081Z", "date_only": false, "value": "2026-09-04T17:10:05.081000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.3.release_date"}, {"timestamp": "2026-09-04T17:10:59.058Z", "date_only": false, "value": "2026-09-04T17:10:59.058130+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.4.discovery_date"}, {"timestamp": "2026-09-04T17:10:59.058Z", "date_only": false, "value": "2026-09-04T17:10:59.058130+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-09-04T17:10:59.058Z", "date_only": false, "value": "2026-09-04T17:10:59.058130+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.6.discovery_date"}, {"timestamp": "2026-09-04T17:15:50.619Z", "date_only": false, "value": "2026-09-04T17:15:50.619000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-09-04T17:21:01.599Z", "date_only": false, "value": "2026-09-04T17:21:01.599799+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-09-04T17:21:46.263Z", "date_only": false, "value": "2026-09-04T17:21:46.263Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-18149", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-04T17:21:46.263Z", "date_only": false, "value": "2026-09-04T17:21:46.263000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-09-04T17:21:46.263Z", "date_only": false, "value": "2026-09-04T17:21:46.263000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2026-09-04T17:21:46.263Z", "date_only": false, "value": "2026-09-04T17:21:46.263000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-09-04T17:21:46.263Z", "date_only": false, "value": "2026-09-04T17:21:46.263Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / openjs", "record": "CVE-2026-18149", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-04T17:23:53.949Z", "date_only": false, "value": "2026-09-04T17:23:53.949898+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.3.discovery_date"}, {"timestamp": "2026-09-04T17:23:53.949Z", "date_only": false, "value": "2026-09-04T17:23:53.949898+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-09-04T17:23:53.949Z", "date_only": false, "value": "2026-09-04T17:23:53.949898+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.5.discovery_date"}, {"timestamp": "2026-09-04T17:24:08.635Z", "date_only": false, "value": "2026-09-04T17:24:08.635422Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mupi6ljdq22w", "record": "CVE-2026-18149", "field": "creation_timestamp", "uuid": "af995e9b-84fc-4c10-8204-e1b97089d18a", "content": "\ud83d\udea8 Moderate-severity security fix in undici (7.29.1, 8.10.2) just released!\n\nPatches CVE-2026-18149: undici vulnerable to Denial of Service via orphaned RetryHandler response body\n\ngithub.com/nodejs/undic...", "url": "https://bsky.app/profile/ulisesgascon.com/post/3mupi6ljdq22w"}, {"timestamp": "2026-09-04T17:26:35.687Z", "date_only": false, "value": "2026-09-04T17:26:35.687862+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-09-04T17:34:19.339Z", "date_only": false, "value": "2026-09-04T17:34:19.339068+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-09-04T17:34:19.339Z", "date_only": false, "value": "2026-09-04T17:34:19.339068+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "vulnerabilities.0.discovery_date"}, {"timestamp": "2026-09-04T17:34:19.339Z", "date_only": false, "value": "2026-09-04T17:34:19.339068+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-09-04T17:49:39.921Z", "date_only": false, "value": "2026-09-04T17:49:39.921559Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-18149", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-09-04T17:49:39.921Z", "date_only": false, "value": "2026-09-04T17:49:39.921559Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-18149", "record": "FKIE_CVE-2026-18149", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-04T17:49:50.163Z", "date_only": false, "value": "2026-09-04T17:49:50.163Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-18149", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-04T17:49:50.163Z", "date_only": false, "value": "2026-09-04T17:49:50.163Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-18149", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-04T18:17:00Z", "date_only": false, "value": "2026-09-04T18:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-18149", "record": "UBUNTU-CVE-2026-18149", "field": "published"}, {"timestamp": "2026-09-04T18:17:49Z", "date_only": false, "value": "2026-09-04T18:17:49Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-PMJH-FQ2X-6V4X", "record": "GHSA-PMJH-FQ2X-6V4X", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-09-04T18:17:49.733Z", "date_only": false, "value": "2026-09-04T18:17:49.733", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-18149", "record": "FKIE_CVE-2026-18149", "field": "published"}, {"timestamp": "2026-09-07T15:40:01Z", "date_only": false, "value": "2026-09-07T15:40:01+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-09T01:03:32Z", "date_only": false, "value": "2026-09-09T01:03:32.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-18149", "record": "MSRC_CVE-2026-18149", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-09T01:03:32Z", "date_only": false, "value": "2026-09-09T01:03:32.000Z", "kind": "other", "label": "Date", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-18149", "record": "MSRC_CVE-2026-18149", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-09-09T01:03:32Z", "date_only": false, "value": "2026-09-09T01:03:32.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-18149", "record": "MSRC_CVE-2026-18149", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-09T13:42:29Z", "date_only": false, "value": "2026-09-09T13:42:29+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-09T13:42:29Z", "date_only": false, "value": "2026-09-09T13:42:29+00:00", "kind": "other", "label": "Date", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "vulnerabilities.0.remediations.0.date"}, {"timestamp": "2026-09-09T13:42:29Z", "date_only": false, "value": "2026-09-09T13:42:29+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-09T14:45:27Z", "date_only": false, "value": "2026-09-09T14:45:27.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-18149", "record": "MSRC_CVE-2026-18149", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-09T17:08:02Z", "date_only": false, "value": "2026-09-09T17:08:02+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-12T14:49:17Z", "date_only": false, "value": "2026-09-12T14:49:17.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-18149", "record": "MSRC_CVE-2026-18149", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-09-16T20:41:26.947Z", "date_only": false, "value": "2026-09-16T20:41:26.947", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-18149", "record": "FKIE_CVE-2026-18149", "field": "lastModified"}, {"timestamp": "2026-09-17T01:46:30Z", "date_only": false, "value": "2026-09-17T01:46:30.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-18149", "record": "MSRC_CVE-2026-18149", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-09-17T01:46:30Z", "date_only": false, "value": "2026-09-17T01:46:30.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-18149", "record": "MSRC_CVE-2026-18149", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-17T07:09:21.775Z", "date_only": false, "value": "2026-09-17T07:09:21.775Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-18149", "record": "MSRC_CVE-2026-18149", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-20T13:06:48Z", "date_only": false, "value": "2026-09-20T13:06:48+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-21T00:00:00Z", "date_only": true, "value": "2026-09-21", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1233", "record": "CERTFR-2026-AVI-1233", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2026-09-22T00:00:00Z", "date_only": true, "value": "2026-09-22", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1233", "record": "CERTFR-2026-AVI-1233", "field": "vendor_advisories.2.published_at"}, {"timestamp": "2026-09-23T00:00:00Z", "date_only": true, "value": "2026-09-23", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1233", "record": "CERTFR-2026-AVI-1233", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-24T00:00:00Z", "date_only": true, "value": "2026-09-24", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1233", "record": "CERTFR-2026-AVI-1233", "field": "vendor_advisories.8.published_at"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1233", "record": "CERTFR-2026-AVI-1233", "field": "last_revision_date"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1233", "record": "CERTFR-2026-AVI-1233", "field": "initial_release_date"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1233", "record": "CERTFR-2026-AVI-1233", "field": "revisions.0.revision_date"}, {"timestamp": "2026-09-29T00:39:59.293Z", "date_only": false, "value": "2026-09-29T00:39:59.293275Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-TI91814", "record": "CLEANSTART-2026-TI91814", "field": "published"}, {"timestamp": "2026-09-29T18:22:34Z", "date_only": false, "value": "2026-09-29T18:22:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PMJH-FQ2X-6V4X", "record": "GHSA-PMJH-FQ2X-6V4X", "field": "published"}, {"timestamp": "2026-09-29T18:22:35Z", "date_only": false, "value": "2026-09-29T18:22:35Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PMJH-FQ2X-6V4X", "record": "GHSA-PMJH-FQ2X-6V4X", "field": "modified"}, {"timestamp": "2026-09-29T23:30:32Z", "date_only": false, "value": "2026-09-29T23:30:32.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/7e27dd642f9867b84b33f236871de4c5", "record": "CVE-2026-18149", "field": "creation_timestamp", "uuid": "9423cbae-e936-4b3d-8b77-c74c336b78f2", "content": "# CVE-2026-18149: CVE-2026-18149: Unresolved Response Body Hang in Undici RetryHandler\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-18149\n\n## Summary\nA resource management vulnerability in the Undici HTTP client (CWE-772) occurs when the retry interceptor receives a partial body payload followed by a non-retryable response error on a subsequent connection attempt, resulting in orphaned streams and potential Denial of Service (DoS).\n\n## TL;DR\nAn unmitigated resource leak in undici's RetryHandler causes application-level hangs and Denial of Service when handling aborted responses followed by non-retryable errors.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-772\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.9 (Medium)\n- **EPSS Score**: 0.0036 (0.36%)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using Undici HTTP client within 7.x and 8.x version branches.\n- **undici**: >= 7.11.0 < 7.29.1 (Fixed in: `7.29.1`)\n- **undici**: >= 8.0.0 < 8.10.2 (Fixed in: `8.10.2`)\n\n## Mitigation\n\n- Disable retry middleware configurations when interacting with untrusted or external APIs.\n- Implement client-side request timeout wrappers using AbortSignal to prevent indefinite stream hangs.\n- Enforce API gateways or reverse proxies to normalize and sanitize broken TCP connections before they reach application-level clients.\n\n**Remediation Steps:**\n1. Identify all projects and packages containing dependencies on Undici via `npm ls undici`.\n2. Upgrade Undici to version 7.29.1 or 8.10.2 depending on the respective release branch.\n3. Validate the patch behavior by deploying the reproduction test suite in target environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-pmjh-fq2x-6v4x](https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x)\n- [NVD CVE-2026-18149 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-18149)\n- [CVE.org CVE-2026-18149](https://www.cve.org/CVERecord?id=CVE-2026-18149)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-18149) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/7e27dd642f9867b84b33f236871de4c5"}, {"timestamp": "2026-09-30T12:01:15.169Z", "date_only": false, "value": "2026-09-30T12:01:15.169296Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwqcb7c76i2q", "record": "CVE-2026-18149", "field": "creation_timestamp", "uuid": "0630431c-0bee-4b0c-aef7-e13c963bce83", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-18149 impacts undici in 4 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/710\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "url": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwqcb7c76i2q"}, {"timestamp": "2026-10-08T00:00:00Z", "date_only": true, "value": "2026-10-08", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1336", "record": "CERTFR-2026-AVI-1336", "field": "vendor_advisories.13.published_at"}, {"timestamp": "2026-10-08T00:44:59.984Z", "date_only": false, "value": "2026-10-08T00:44:59.984508Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-WL07802", "record": "CLEANSTART-2026-WL07802", "field": "published"}, {"timestamp": "2026-10-08T15:57:57Z", "date_only": false, "value": "2026-10-08T15:57:57Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-TI91814", "record": "CLEANSTART-2026-TI91814", "field": "modified"}, {"timestamp": "2026-10-08T15:58:03Z", "date_only": false, "value": "2026-10-08T15:58:03Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-WL07802", "record": "CLEANSTART-2026-WL07802", "field": "modified"}, {"timestamp": "2026-10-09T11:32:43Z", "date_only": false, "value": "2026-10-09T11:32:43Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-TC48038", "record": "CLEANSTART-2026-TC48038", "field": "modified"}, {"timestamp": "2026-10-10T00:47:54.434Z", "date_only": false, "value": "2026-10-10T00:47:54.434091Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-TC48038", "record": "CLEANSTART-2026-TC48038", "field": "published"}, {"timestamp": "2026-10-11T00:00:00Z", "date_only": true, "value": "2026-10-11", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1336", "record": "CERTFR-2026-AVI-1336", "field": "vendor_advisories.3.published_at"}, {"timestamp": "2026-10-12T00:00:00Z", "date_only": true, "value": "2026-10-12", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1336", "record": "CERTFR-2026-AVI-1336", "field": "vendor_advisories.7.published_at"}, {"timestamp": "2026-10-13T00:00:00Z", "date_only": true, "value": "2026-10-13", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1336", "record": "CERTFR-2026-AVI-1336", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": true, "value": "2026-10-14", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1336", "record": "CERTFR-2026-AVI-1336", "field": "vendor_advisories.15.published_at"}, {"timestamp": "2026-10-15T00:00:00Z", "date_only": true, "value": "2026-10-15", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1336", "record": "CERTFR-2026-AVI-1336", "field": "vendor_advisories.1.published_at"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1336", "record": "CERTFR-2026-AVI-1336", "field": "last_revision_date"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1336", "record": "CERTFR-2026-AVI-1336", "field": "initial_release_date"}, {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1336", "record": "CERTFR-2026-AVI-1336", "field": "revisions.0.revision_date"}, {"timestamp": "2026-10-17T09:38:05Z", "date_only": false, "value": "2026-10-17T09:38:05Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-18149", "record": "UBUNTU-CVE-2026-18149", "field": "modified"}, {"timestamp": "2026-10-19T11:53:39Z", "date_only": false, "value": "2026-10-19T11:53:39+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-19T11:53:39Z", "date_only": false, "value": "2026-10-19T11:53:39+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-19T11:53:39Z", "date_only": false, "value": "2026-10-19T11:53:39+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:54389", "record": "RHSA-2026:54389", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-19T11:53:44Z", "date_only": false, "value": "2026-10-19T11:53:44+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-19T11:53:44Z", "date_only": false, "value": "2026-10-19T11:53:44+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-19T11:53:44Z", "date_only": false, "value": "2026-10-19T11:53:44+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:54438", "record": "RHSA-2026:54438", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-19T11:55:52Z", "date_only": false, "value": "2026-10-19T11:55:52+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-19T11:55:52Z", "date_only": false, "value": "2026-10-19T11:55:52+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-19T11:55:52Z", "date_only": false, "value": "2026-10-19T11:55:52+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:66008", "record": "RHSA-2026:66008", "field": "document.tracking.current_release_date"}]}