https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T01:58:57.754119+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-1528 CVE-2026-1528 — undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client 2026-09-29T01:58:58.751155+00:00

Affected: undici, Red Hat Cryostat 4 on RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Cluster Observability Operator 1.5.0, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9 and 11 more

ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.