PT-2026-25067 · Undici+1 · Undici+1
Adnan Jakati
+2
·
Publicado
2026-03-12
·
Atualizado
2026-05-18
·
CVE-2026-2581
CVSS v3.1
5.9
Média
| Vetor | AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Undici versions prior to 7.24.0
Description
This is an uncontrolled resource consumption issue that can lead to a Denial of Service (DoS). When the
interceptors.deduplicate() function is enabled in vulnerable versions, response data for deduplicated requests can accumulate in memory for downstream handlers. An attacker-controlled or untrusted upstream endpoint can exploit this with large or chunked responses and concurrent identical requests, causing high memory usage and potential Out Of Memory (OOM) process termination. Impacted users are applications that utilize Undici’s deduplication interceptor against endpoints that may produce large or long-lived response bodies. The issue is addressed by changing the deduplication behavior to stream response chunks to downstream handlers as they arrive, instead of accumulating the full body, and by preventing late deduplication when body streaming has already started.Recommendations
Upgrade to Undici version 7.24.0 or later.
Disable the
interceptors.deduplicate() function for affected clients or routes.
Use skipHeaderNames with a marker header to force high-risk requests to bypass deduplication.
Avoid concurrent identical requests to untrusted endpoints that may return very large or chunked bodies.
Apply upstream or proxy response-size and timeout limits.Correção
DoS
Allocation of Resources Without Limits
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Rocky Linux
Undici