{"id":"CVE-2026-13697","title":"undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)","summary":"A flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache …","severity":"high","cvss":7.4,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H","cvssSource":"vendor","cwe":["CWE-524","CWE-200","CWE-248","CWE-525"],"vendor":"Red Hat","product":"Red Hat Hardened Images","affected":["build_of_podman_desktop","enterprise_linux 10","enterprise_linux 9","hardened_images","openshift_ai_rhoai","openshift_container_platform 4","openshift_dev_spaces","secrets_management_console_for_red_hat_openshift","self_service_automation_portal 2","developer_hub 1.10"],"patched":["developer_hub 1.10","hardened_images"],"published":"2026-07-29","updated":"2026-10-09","sourceUpdated":"2026-10-09T23:10:38+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13697.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13697.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-13697"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2508485"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13697"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13697"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-4cwx-7wf7-3272"},{"url":"https://access.redhat.com/errata/RHSA-2026:76788"},{"url":"https://access.redhat.com/errata/RHSA-2026:79088"},{"url":"https://access.redhat.com/errata/RHSA-2026:48537"},{"url":"https://access.redhat.com/errata/RHSA-2026:48273"},{"url":"https://github.com/nodejs/undici/commit/4fe5bc5fefe5ac81a200fc8e1cf84b8bf8464451"},{"url":"https://github.com/nodejs/undici/releases/tag/v7.29.0"},{"url":"https://github.com/nodejs/undici/releases/tag/v8.9.0"},{"url":"https://github.com/advisories/GHSA-4cwx-7wf7-3272"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00569,"epssPercentile":0.46948,"aliases":["GHSA-4cwx-7wf7-3272"],"ecosystem":"npm","ingestedAt":"2026-08-03T19:29:00.316Z","slug":"CVE-2026-13697","body":"## Overview\n\nA flaw was found in undici. This vulnerability allows for cross-user information disclosure when malformed Cache-Control private directives cause private response bodies and headers, such as Set-Cookie data, to be stored in a shared cache and subsequently exposed to other users. Additionally, a specially crafted Cache-Control header can trigger an unhandled error in the cache parser, leading to a process termination and a Denial of Service (DoS). Both issues affect applications using the cache interceptor in shared mode.\n\n## Vendor advisories\n\n- **RHSA-2026:76788** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:76788)\n- **RHSA-2026:79088** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79088)\n- **RHSA-2026:48537** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48537)\n- **RHSA-2026:48273** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48273)\n- **Red Hat VEX** · Important · affected: Red Hat Build of Podman Desktop, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat Hardened Images, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, … · no fix planned: Red Hat Build of Podman Desktop, Red Hat Hardened Images, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13697.json)\n\n**undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives** — rated Important by Red Hat. Released 2026-07-29, updated 2026-10-09.\n\nAffected:\n\n- Red Hat Build of Podman Desktop\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat Hardened Images\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Dev Spaces\n- Secrets Management Console for Red Hat OpenShift\n- Self-service automation portal 2\n\nFixed:\n\n- Red Hat Developer Hub 1.10\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Red Hat Build of Podman Desktop\n- Red Hat Hardened Images\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat OpenShift Dev Spaces\n- Secrets Management Console for Red Hat OpenShift\n- Self-service automation portal 2\n\nNot affected:\n\n- Red Hat Developer Hub 1.10\n- Red Hat Hardened Images\n- Cryostat 4\n- Exploit Intelligence\n- Red Hat AMQ Broker 7\n- Red Hat Ansible Automation Platform 2\n- Red Hat Build of Podman Desktop\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n\n## Remediation\n\nFor more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:76788\nFor more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:79088\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/ https://access.redhat.com/errata/RHSA-2026:48537\n\n## Package advisory (CVE-2026-13697)\n\nAffected packages:\n\n- `undici >= 7.0.0, < 7.29.0`\n- `undici >= 8.0.0, < 8.9.0`\n\nPatched in:\n\n- `undici 7.29.0`\n- `undici 8.9.0`\n\nSource: https://github.com/advisories/GHSA-4cwx-7wf7-3272","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":40.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}