CVE-2026-67317

Aliases:UBUNTU-CVE-2026-67317DEBIAN-CVE-2026-67317GHSA-jqh4-m9w3-8hp9CGA-2h3m-9ppv-26gpCGA-2xmv-7xjw-vvfgCGA-3q3g-mj25-xx6hCGA-58q8-wqgg-vvjqCGA-5prg-2956-g3x3CGA-6mp5-xj3w-x2v5CGA-755p-wfj8-3w3mCGA-8hqv-47cg-3p3jCGA-crvp-7p23-48cgCGA-fhgp-vqhx-ghcvCGA-g32r-3j8p-7r94CGA-g6fp-jj7j-cw3pCGA-h2fg-4xv8-vmgmCGA-h7rx-6235-q2c8CGA-hqww-xfg7-c9jjCGA-hv92-c926-8497CGA-j9wf-rgxp-65x2CGA-m467-54jj-jcx5CGA-mfqx-m86f-j543CGA-2757-2hwh-22j2CGA-27mh-gvv6-6p87CGA-296q-29j6-f32cCGA-2q7p-gmrp-9854CGA-35v8-5p4w-rmcwCGA-39xf-8rcv-6gw2CGA-3fvh-79hv-w84rCGA-3hcr-j3qc-66vgCGA-3hww-6x26-9qxrCGA-3wjv-77c7-2xfjCGA-44fp-2w69-5h56CGA-4pvf-chpv-5j3wCGA-4qx2-p88f-229hCGA-4wpw-354f-6m5wCGA-5223-mxq2-h5rwCGA-55w5-49q2-rgc7CGA-5cj8-hm63-wr5mCGA-5cr6-f4p5-jc8hCGA-5gwx-p79h-wp2fCGA-5w64-6p3c-wj38CGA-5xcc-r7pp-q4r7CGA-5xxr-8gw4-rp84CGA-65vj-fmpq-p73wCGA-67xh-453x-x2cwCGA-68rg-rfgr-57vrCGA-69xh-gjww-m964CGA-6q3j-rqwm-fvfmCGA-6rw2-hjwc-9j4gCGA-6v2j-43wh-8p7cCGA-72mh-qg63-q779CGA-768q-7p33-9g25CGA-78w8-6vv7-xvc4CGA-78x2-gv75-9fx3CGA-7wwr-p5h5-p374CGA-83hc-pcf2-q9hrCGA-83hq-gjgm-cq57CGA-83j8-f9mx-qpmqCGA-852h-h3pw-jhvvCGA-85rq-63h7-c627CGA-8656-prcm-j4mhCGA-8939-g2xh-2hqwCGA-8f7c-jqj8-74wwCGA-8gqx-4gq3-mqvxCGA-8v82-mcc5-vjqjCGA-9437-gf44-4c64CGA-949f-r98v-jcj7CGA-9843-222x-f45fCGA-99gr-3vhc-76vwCGA-9fpc-g6pr-9v8qCGA-9h74-432f-vxhrCGA-9qgv-4c69-pcffCGA-9vfw-8fx4-mr92CGA-9xh4-rg43-jgpxCGA-c3f4-cp7w-wxh3CGA-c8jj-pcf5-c7jrCGA-ch65-8g2m-jrp5CGA-cpw8-c3gx-whr2CGA-cqc3-r2mr-6rx2CGA-cqcj-g9fr-gjqhCGA-crpp-cv2m-2xp3CGA-cw3p-x78q-2jrrCGA-cwqp-m647-q87qCGA-f4h5-jgrh-wh7hCGA-f7p3-92jf-j77rCGA-fpj9-hj53-98m6CGA-fqmf-46m8-8fxvCGA-g63m-ffr5-chhfCGA-g8h4-3c57-8xh8CGA-gg88-q6ww-j3p8CGA-gj34-vhwm-8cx7CGA-gmmf-wrhp-gjrjCGA-gmr6-pcjw-pmh7CGA-gmw9-www6-mh5wCGA-gv67-453p-m868CGA-gvqj-m3jq-878jCGA-gx44-8hwc-cmfrCGA-h642-cwvg-vqvfCGA-h6x7-pw93-2734CGA-hcpj-fj6p-7j98CGA-hg4w-hh5c-2rwxCGA-hgvv-7ph3-65j4CGA-hp6f-3jr4-225jCGA-j2h6-qjg2-x4wmCGA-j3mf-fpgp-wr7rCGA-j429-4375-mj2rCGA-j5jw-gmf3-ff25CGA-j8gq-6ww7-7g9xCGA-jj36-c9wc-pwjfCGA-jpmh-27q5-cgqqCGA-jq36-6p7p-7g39CGA-m49x-h2xv-8g8mCGA-m56c-g5pr-wq7xCGA-m6f3-479m-cqf9CGA-m9gv-x2mf-fqmmCGA-m9mp-mhm5-hm5wCGA-mfr8-gj5f-h7q6CGA-mg6r-626g-m2mxCGA-mhr6-vxr9-xp36CGA-mjgv-vwrg-9cgxCGA-mjww-h5f3-9r5qCGA-mqc8-v76r-m6gxCGA-mv4q-h8v6-823jCGA-mvgx-422m-wvg4CGA-mw7h-cxx8-474cCGA-mxwg-4897-3vh7CGA-p3g9-wrqm-c8mhCGA-p48m-rxvj-mwrfCGA-p5g7-6gg2-rrx4CGA-p64m-24qc-crfqCGA-p75j-pwrj-wxr2CGA-p7mx-r5f3-7fj4CGA-pchx-2x52-p35fCGA-phjh-96g2-6836CGA-pp57-2f79-5jm7CGA-ppfw-fx7f-69m5CGA-ppmg-jrq4-r9w4CGA-pq5v-72v4-mqpvCGA-pv88-5qxv-r9f2CGA-q27g-c4v8-37h8CGA-q2p3-5j82-5325CGA-q4w4-74fv-r9x6CGA-q68m-82qh-pjx3CGA-qc5j-f5qv-w7g4CGA-qcmg-ppgp-mg7fCGA-qg9g-fgrx-wgp4CGA-qjxw-5hm8-cx96CGA-qmvv-fc3w-fxrjCGA-qrwq-gf5j-hfv3CGA-qxfm-vjpf-c2h8CGA-r642-22cc-j2m9CGA-r6c7-47v8-95rfCGA-r7wm-9p69-f22cCGA-rhg7-r2vv-wqrwCGA-rm8f-vpq4-f286CGA-v24x-c828-6q6qCGA-v6f2-qj8g-732pCGA-v9h8-wq7w-wq6xCGA-vcmh-j4wg-qr58CGA-vf6j-4vpj-5vvgCGA-vf77-99fm-5j3qCGA-vjh5-3mf7-w3prCGA-vp8x-3hvf-vxhfCGA-vq3q-hhcp-2pxhCGA-vq45-6rpr-j49hCGA-w6vc-3m7j-xvxwCGA-w7p5-j3c4-cvxrCGA-w8c7-2fpg-v5v3CGA-wcf5-p4pc-qpg4CGA-wg33-vv6g-47cgCGA-wp8g-pmjp-85jhCGA-wrcj-mm2w-rx52CGA-wvff-5fp6-w974CGA-wvrc-ccph-h7j9CGA-wwg6-c87r-w6rcCGA-x3pp-gq9v-hp6pCGA-x9hm-9mvf-25f3CGA-xf7r-3xrm-5jwpCGA-xg6f-w8xf-p5jhCGA-xh5p-w36q-8q8gCGA-xqcr-9q3p-5vf6CGA-xqv7-j65c-84qwCGA-xrh6-qf98-3hwqCGA-xvgq-96h3-qpx8CGA-xxm6-7584-qhqcCGA-2fhc-m555-fmwc
Advisory lineage Upstream: 2 Downstream: 3
Analyzed
Published: 01 Aug 2026, 12:22
Last modified:03 Aug 2026, 18:25

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (nvd)
EPSS Score
0.5% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

01 Aug 2026, 12:22
Published
Vulnerability first disclosed
03 Aug 2026, 18:25
Last Modified
Vulnerability information updated

Description

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.

CVSS Metrics

  • v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
  • v4.0•MEDIUM•Score: 6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.50%• Percentile: 42%

Techniques & Countermeasures

  • CWE-770•Allocation of Resources Without Limits or Throttling

    The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected Systems

  • chainguard•airflow-2

    all

  • chainguard•airflow-core-2

    all

  • chainguard•awx

    < 24.6.1-r45

  • chainguard•gitlab-rails-ce-18.1

    all

  • chainguard•gitlab-rails-ce-18.10

    all

  • chainguard•gitlab-rails-ce-18.6

    all

  • chainguard•gitlab-rails-ce-18.7

    all

  • chainguard•gitlab-rails-ce-18.8

    all

  • chainguard•gitlab-rails-ce-18.9

    all

  • chainguard•gitlab-rails-ce-19.0

    all

  • chainguard•gitlab-rails-ce-19.1

    all | < 19.1.7-r6

  • chainguard•gitlab-rails-ce-19.2

    all | < 19.2.5-r2

  • chainguard•gitlab-rails-ce-19.3

    < 19.3.1-r6

  • chainguard•gitlab-rails-ce-fips-18.1

    all

  • chainguard•gitlab-rails-ce-fips-18.10

    all

  • chainguard•gitlab-rails-ce-fips-18.6

    all

  • chainguard•gitlab-rails-ce-fips-18.7

    all

  • chainguard•gitlab-rails-ce-fips-18.8

    all

  • chainguard•gitlab-rails-ce-fips-18.9

    all

  • chainguard•gitlab-rails-ce-fips-19.0

    all

  • chainguard•gitlab-rails-ce-fips-19.1

    all | < 19.1.7-r7

  • chainguard•gitlab-rails-ce-fips-19.2

    all | < 19.2.5-r2

  • chainguard•gitlab-rails-ce-fips-19.3

    < 19.3.1-r3

  • chainguard•jitsucom-jitsu-console

    < 2.11.0-r30

  • chainguard•kibana-8.17

    < 8.17.10-r31

  • chainguard•kibana-8.17-bitnami

    < 8.17.10-r31

  • chainguard•kibana-8.17-iamguarded

    < 8.17.10-r31

  • chainguard•kibana-8.19

    < 8.19.18-r2

  • chainguard•kibana-8.19-bitnami

    < 8.19.18-r2

  • chainguard•kibana-8.19-iamguarded

    < 8.19.18-r2

  • chainguard•kibana-9.0

    < 9.0.8-r34

  • chainguard•kibana-9.0-bitnami

    < 9.0.8-r34

  • chainguard•kibana-9.0-iamguarded

    < 9.0.8-r34

  • chainguard•kibana-9.1

    < 9.1.10-r30

  • chainguard•kibana-9.1-iamguarded

    < 9.1.10-r30

  • chainguard•kibana-9.2

    < 9.2.8-r18

  • chainguard•kibana-9.2-iamguarded

    < 9.2.8-r18

  • chainguard•kibana-9.3

    < 9.3.8-r1

  • chainguard•kibana-9.3-iamguarded

    < 9.3.8-r1

  • chainguard•kibana-9.4

    < 9.4.4-r3

  • chainguard•kibana-9.4-iamguarded

    < 9.4.4-r3

  • chainguard•kubeflow-centraldashboard

    < 1.10.0-r26

  • chainguard•langfuse-2

    < 2.95.12-r35

  • chainguard•langfuse-2-worker

    < 2.95.12-r35

  • chainguard•langfuse-3

    < 3.223.0-r0

  • chainguard•langfuse-3-compat

    < 3.225.7-r6

  • chainguard•langfuse-3-worker

    < 3.223.0-r0

  • chainguard•langfuse-fips-2

    < 2.95.12-r38

  • chainguard•langfuse-fips-2-worker

    < 2.95.12-r38

  • chainguard•langfuse-fips-3

    < 3.223.0-r0

Showing first 50 affected entries in server-rendered view.

References (12)