{"id":"CVE-2026-9678","title":"undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)","summary":"A flaw was found in Undici. The cache interceptor in shared-cache mode incorrectly classifies certain responses as cacheable due to improper handling of whitespace-padded Cache-Control header field names. This vulnerability allows an unaut…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-1286","CWE-524"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 8)","affected":["cryostat 4","openshift_pipelines","amq_broker 7","build_of_podman_desktop","developer_hub","enterprise_linux 8","openshift_ai_rhoai","openshift_container_platform 4","openshift_data_foundation 4","openshift_dev_spaces","self_service_automation_portal 2","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_v_9","hardened_images"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_v_9","hardened_images"],"published":"2026-06-17","updated":"2026-10-01","sourceUpdated":"2026-10-01T17:20:00+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9678.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9678.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-9678"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2490000"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9678"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9678"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-pr7r-676h-xcf6"},{"url":"https://access.redhat.com/errata/RHSA-2026:35842"},{"url":"https://access.redhat.com/errata/RHSA-2026:35841"},{"url":"https://access.redhat.com/errata/RHSA-2026:41947"},{"url":"https://access.redhat.com/errata/RHSA-2026:39868"},{"url":"https://access.redhat.com/errata/RHSA-2026:35892"},{"url":"https://access.redhat.com/errata/RHSA-2026:35891"},{"url":"https://access.redhat.com/errata/RHSA-2026:38236"},{"url":"https://access.redhat.com/errata/RHSA-2026:7378"},{"url":"https://access.redhat.com/errata/RHSA-2026:22380"},{"url":"https://github.com/advisories/GHSA-pr7r-676h-xcf6"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00388,"epssPercentile":0.329,"ecosystem":"npm","ingestedAt":"2026-06-19T03:39:00.823Z","slug":"CVE-2026-9678","body":"## Overview\n\nA flaw was found in Undici. The cache interceptor in shared-cache mode incorrectly classifies certain responses as cacheable due to improper handling of whitespace-padded Cache-Control header field names. This vulnerability allows an unauthenticated attacker to access authenticated user data from the cache, leading to information disclosure. This occurs when both authenticated and unauthenticated requests resolve to the same cache key.\n\n## Vendor advisories\n\n- **RHSA-2026:35842** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35842)\n- **RHSA-2026:35841** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35841)\n- **RHSA-2026:41947** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41947)\n- **RHSA-2026:39868** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:39868)\n- **RHSA-2026:35892** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35892)\n- **RHSA-2026:35891** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-07-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:35891)\n- **RHSA-2026:38236** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-11 · [advisory](https://access.redhat.com/errata/RHSA-2026:38236)\n- **RHSA-2026:7378** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-04-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:7378)\n- **RHSA-2026:22380** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-06-02 · [advisory](https://access.redhat.com/errata/RHSA-2026:22380)\n- **Red Hat VEX** · Moderate · affected: Cryostat 4, OpenShift Pipelines, Red Hat AMQ Broker 7, Red Hat Build of Podman Desktop, Red Hat Developer Hub, Red Hat Enterprise Linux 8, … · no fix planned: Cryostat 4, OpenShift Pipelines, Red Hat AMQ Broker 7, Red Hat Build of Podman Desktop, … · updated 2026-10-01 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9678.json)\n\n**undici: Undici: Information disclosure due to improper cache-control header parsing** — rated Moderate by Red Hat. Released 2026-06-17, updated 2026-10-01.\n\nAffected:\n\n- Cryostat 4\n- OpenShift Pipelines\n- Red Hat AMQ Broker 7\n- Red Hat Build of Podman Desktop\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Self-service automation portal 2\n\nFixed:\n\n- Red Hat Enterprise Linux AppStream (v. 10)\n- Red Hat Enterprise Linux AppStream (v. 8)\n- Red Hat Enterprise Linux AppStream (v. 9)\n- Red Hat Hardened Images\n\nNo fix planned:\n\n- Cryostat 4\n- OpenShift Pipelines\n- Red Hat AMQ Broker 7\n- Red Hat Build of Podman Desktop\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 8\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Openshift Data Foundation 4\n- Red Hat OpenShift Dev Spaces\n- Self-service automation portal 2\n\nNot affected:\n\n- Red Hat Hardened Images\n- Red Hat OpenShift AI (RHOAI)\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:35842\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:35841\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:41947\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2026-9678)\n\nAffected packages:\n\n- `undici >= 7.0.0, < 7.28.0`\n- `undici >= 8.0.0, < 8.5.0`\n\nPatched in:\n\n- `undici 7.28.0`\n- `undici 8.5.0`\n\nSource: https://github.com/advisories/GHSA-pr7r-676h-xcf6","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}