https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:42:48 +0000 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1233 certfr-2026-avi-1233 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1233 https://vulnerability.circl.lu/vuln/cleanstart-2026-nt71796 <p><strong>Affected:</strong> CleanStart: langfuse</p> <p>Security vulnerability affects the langfuse package. undici&#39;s BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON.</p> <p><strong>Affected:</strong> CleanStart: langfuse</p> <p>Security vulnerability affects the langfuse package. undici&#39;s BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON.</p> https://vulnerability.circl.lu/vuln/cleanstart-2026-nt71796 https://vulnerability.circl.lu/vuln/fkie_cve-2026-84961 <p>undici&#39;s BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application&#39;s custom checkServerIdentity was written to reject, but which still passes Node&#39;s default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.</p> <p>undici&#39;s BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application&#39;s custom checkServerIdentity was written to reject, but which still passes Node&#39;s default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-84961 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11884-1 <p>pi-coding-agent-0.87.1-1.1 on GA media</p> <p>pi-coding-agent-0.87.1-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11884-1 https://vulnerability.circl.lu/vuln/rhsa-2026:54438 <p>undici: undici: Denial of Service due to orphaned response body in retry handler undici: undici: Denial of Service via unbounded decompression of compressed responses undici: undici: Cross-user cookie disclosure via Set-Cookie caching undici: Undici: Response truncation and connection termination undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options undici: undici: Integrity failure due to caching of unsafe HTTP method responses undici: undici: Denial of Service via WebSocketStream unclean close undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation</p> <p>undici: undici: Denial of Service due to orphaned response body in retry handler undici: undici: Denial of Service via unbounded decompression of compressed responses undici: undici: Cross-user cookie disclosure via Set-Cookie caching undici: Undici: Response truncation and connection termination undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options undici: undici: Integrity failure due to caching of unsafe HTTP method responses undici: undici: Denial of Service via WebSocketStream unclean close undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation</p> https://vulnerability.circl.lu/vuln/rhsa-2026:54438 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-84961 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>undici&#39;s BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application&#39;s custom checkServerIdentity was written to reject, but which still passes Node&#39;s default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-undici, Ubuntu:26.04:LTS: node-undici</p> <p>undici&#39;s BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector inside the connect option, is silently discarded before it reaches the TLS layer. As a result a peer whose certificate the application&#39;s custom checkServerIdentity was written to reject, but which still passes Node&#39;s default hostname and chain checks, is accepted when reached through BalancedPool. The Client, Pool, and Agent dispatchers are not affected because they extract the connect and tls options before cloning. This affects undici versions from 7.24.1 up to 7.29.1 and from 8.0.0 up to 8.10.2, and only when the application supplies a function-valued connect or tls option to BalancedPool. Users should upgrade to undici 7.29.1 or 8.10.2.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-84961