https://vulnerability.circl.lu/sightings/feed 2026-09-30T16:39:46.955452+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/0630431c-0bee-4b0c-aef7-e13c963bce83/export 2026-09-30T16:39:46.998787+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "0630431c-0bee-4b0c-aef7-e13c963bce83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18149", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mwqcb7c76i2q", "content": "\n\ud83d\udea8 New MEDIUM CVE detected in AWS Lambda \ud83d\udea8\nCVE-2026-18149 impacts undici in 4 Lambda base images.\n\nDetails: https://github.com/aws/aws-lambda-base-images/issues/710\nMore: https://lambdawatchdog.com/\n\n#AWS #Lambda #CVE #CloudSecurity #Serverless", "creation_timestamp": "2026-09-30T12:01:15.169296Z"} 2026-09-30T12:01:15.169296+00:00 https://vulnerability.circl.lu/sighting/9423cbae-e936-4b3d-8b77-c74c336b78f2/export 2026-09-30T16:39:47.000311+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "9423cbae-e936-4b3d-8b77-c74c336b78f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18149", "type": "seen", "source": "https://gist.github.com/alon710/7e27dd642f9867b84b33f236871de4c5", "content": "# CVE-2026-18149: CVE-2026-18149: Unresolved Response Body Hang in Undici RetryHandler\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-09-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-18149\n\n## Summary\nA resource management vulnerability in the Undici HTTP client (CWE-772) occurs when the retry interceptor receives a partial body payload followed by a non-retryable response error on a subsequent connection attempt, resulting in orphaned streams and potential Denial of Service (DoS).\n\n## TL;DR\nAn unmitigated resource leak in undici's RetryHandler causes application-level hangs and Denial of Service when handling aborted responses followed by non-retryable errors.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-772\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.9 (Medium)\n- **EPSS Score**: 0.0036 (0.36%)\n- **Impact**: Denial of Service (DoS)\n- **Exploit Status**: Proof-of-Concept (PoC) available\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- Node.js applications using Undici HTTP client within 7.x and 8.x version branches.\n- **undici**: >= 7.11.0 < 7.29.1 (Fixed in: `7.29.1`)\n- **undici**: >= 8.0.0 < 8.10.2 (Fixed in: `8.10.2`)\n\n## Mitigation\n\n- Disable retry middleware configurations when interacting with untrusted or external APIs.\n- Implement client-side request timeout wrappers using AbortSignal to prevent indefinite stream hangs.\n- Enforce API gateways or reverse proxies to normalize and sanitize broken TCP connections before they reach application-level clients.\n\n**Remediation Steps:**\n1. Identify all projects and packages containing dependencies on Undici via `npm ls undici`.\n2. Upgrade Undici to version 7.29.1 or 8.10.2 depending on the respective release branch.\n3. Validate the patch behavior by deploying the reproduction test suite in target environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-pmjh-fq2x-6v4x](https://github.com/nodejs/undici/security/advisories/GHSA-pmjh-fq2x-6v4x)\n- [NVD CVE-2026-18149 Details](https://nvd.nist.gov/vuln/detail/CVE-2026-18149)\n- [CVE.org CVE-2026-18149](https://www.cve.org/CVERecord?id=CVE-2026-18149)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-18149) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T23:30:32.000000Z"} 2026-09-29T23:30:32+00:00 https://vulnerability.circl.lu/sighting/af995e9b-84fc-4c10-8204-e1b97089d18a/export 2026-09-30T16:39:47.000473+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "af995e9b-84fc-4c10-8204-e1b97089d18a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18149", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mupi6ljdq22w", "content": "\ud83d\udea8 Moderate-severity security fix in undici (7.29.1, 8.10.2) just released!\n\nPatches CVE-2026-18149: undici vulnerable to Denial of Service via orphaned RetryHandler response body\n\ngithub.com/nodejs/undic...", "creation_timestamp": "2026-09-04T17:24:08.635422Z"} 2026-09-04T17:24:08.635422+00:00