{"schemaVersion":3,"id":"CVE-2026-9679","aliases":["UBUNTU-CVE-2026-9679","DEBIAN-CVE-2026-9679","CGA-4mw6-q9mf-5cf9","CGA-5mx2-gq8r-3v7q","CGA-67j2-7m9g-35j6","CGA-73wg-4hwg-87c9","CGA-7jmr-4hj9-q7rc","CGA-86v8-3h7f-7vw6","CGA-943w-rpm5-gc7r","CGA-97pc-9rx4-hhp9","CGA-c9c4-7jqh-w9vj","CGA-g4j2-q4cv-2pm3","CGA-gg84-fvrm-c2gc","CGA-gvrp-v4p2-65f2","CGA-j25g-hhpp-x3wr","CGA-jvxp-mqq7-wmcp","CGA-mj9w-hhfj-j7xv","CGA-mwhh-3h84-mv83","CGA-r5pr-rfgx-8jj6","CGA-v489-gm2w-c598","CGA-wwf8-xh25-3vmp","GHSA-p88m-4jfj-68fv","CGA-23rp-cm7r-744q","CGA-2f2x-rjm7-p8vr","CGA-2v74-5mxp-6pwh","CGA-3237-w82m-fccr","CGA-3p33-48h2-2pvj","CGA-46hx-p8gq-443m","CGA-544j-2727-m275","CGA-5894-7g76-xp93","CGA-5fpc-c437-8297","CGA-679h-xw7m-g998","CGA-68mr-c863-2fp5","CGA-774g-4r4g-q8hh","CGA-7hwh-7fp6-mp4v","CGA-7p47-mp2j-q5c6","CGA-8322-5wj9-cfxc","CGA-84vh-9hw9-xxwp","CGA-858w-6739-mpq5","CGA-865g-mwx3-794h","CGA-8929-939c-hm82","CGA-8c7r-mqq7-mf2q","CGA-8ggq-3c8h-ffqp","CGA-8xhr-h5x5-6j6j","CGA-9xcg-v925-5f44","CGA-ch29-gcg7-rw8q","CGA-chg2-vpv3-c73v","CGA-cr66-pq99-8q5v","CGA-crgr-hmw8-2jg9","CGA-fg8x-frwv-fj83","CGA-g68p-5vxj-ffwr","CGA-gcvr-w28g-pv6v","CGA-h475-rhpg-8chq","CGA-h9g9-rqrg-wvvj","CGA-hgqg-xpxw-83p2","CGA-hvgm-qc22-rx9p","CGA-j8x2-xw7c-466p","CGA-jjg7-xwmv-v8g6","CGA-jwj3-fhfm-qg6c","CGA-p562-x7cv-xgcf","CGA-p8x6-3crw-vp9c","CGA-q3pc-qq3m-p95r","CGA-q55x-w3gv-2pjr","CGA-qx84-p8rm-cx2m","CGA-r7h7-mpgf-fj8v","CGA-rfh3-3c6x-4gq4","CGA-rqqx-8hgx-fghc","CGA-v7vv-569j-46j7","CGA-v9wq-qg4v-7jhm","CGA-vcmw-qjmg-5rp2","CGA-vcxq-chfc-rqwh","CGA-w2h8-rj7w-m3qg","CGA-w45f-xq68-6p39","CGA-w6cq-jrwh-p4hq","CGA-wqjv-8p5g-5rcc","CGA-wqqw-7cqc-v6p3","CGA-x6vj-x6hh-4823","CGA-xrhc-8wm9-rg9q"],"status":"published","duplicateOf":null,"title":null,"description":"Impact:\nundici's cookie parser in parseSetCookie percent-decodes cookie values via qsUnescape, turning encoded sequences like %0D%0A, %00, %3B, and %3D into their literal byte equivalents. RFC 6265 §5.4 does not specify any decoding and browsers do not decode either.\n\nApplications that parse a Set-Cookie header and then forward the parsed value into a response header (proxies, middleware, SSR frameworks) become vulnerable to HTTP response header injection: an attacker-controlled upstream can inject arbitrary Set-Cookie, Location, or Cache-Control headers into the application's downstream response, enabling session fixation, open redirect, or cache poisoning.\n\nAffected applications are those that use undici's cookie parsing (parseSetCookie, parseCookie, getSetCookies) and forward the parsed cookie value into a response header.\n\nThis was introduced in undici 7.0.0 via PR #3789.\n\nPatches:\nUpgrade to undici v6.26.0, v7.28.0 or v8.5.0.\n\nWorkarounds:\nIf upgrade is not immediately possible, do not forward values returned by parseSetCookie/parseCookie/getSetCookies directly into response headers; sanitize the value first to strip or reject CR, LF, NUL, ;, and = bytes.","dates":{"published":"2026-06-17T16:56:18.579Z","modified":"2026-06-23T16:12:38.765Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.9,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":5.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.9,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00332,"percentile":0.24914,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.07500000000000002,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00257},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00332,"percentile":0.24914}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00257,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00332,"percentile":0.24914}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-93","name":"Improper Neutralization of CRLF Sequences ('CRLF Injection')","description":"The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/93.html"}],"affected":[{"vendor":"chainguard","product":"actions-runner","name":"actions-runner","label":"actions-runner","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/actions-runner","purlType":"apk","versions":[{"text":"< 2.335.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.335.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"code-server","name":"code-server","label":"code-server","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/code-server","purlType":"apk","versions":[{"text":"< 4.125.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.125.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.1","name":"commercial-gitlab-rails-ee-19.1","label":"commercial-gitlab-rails-ee-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.2","name":"commercial-gitlab-rails-ee-19.2","label":"commercial-gitlab-rails-ee-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.3","name":"commercial-gitlab-rails-ee-19.3","label":"commercial-gitlab-rails-ee-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.1","name":"commercial-gitlab-rails-ee-fips-19.1","label":"commercial-gitlab-rails-ee-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.2","name":"commercial-gitlab-rails-ee-fips-19.2","label":"commercial-gitlab-rails-ee-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.3","name":"commercial-gitlab-rails-ee-fips-19.3","label":"commercial-gitlab-rails-ee-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gemini-cli","name":"gemini-cli","label":"gemini-cli","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gemini-cli","purlType":"apk","versions":[{"text":"< 0.49.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.49.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"haraka","name":"haraka","label":"haraka","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/haraka","purlType":"apk","versions":[{"text":"< 3.3.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.3.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.16-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.16-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.16-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.16-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"< 8.19.16-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.16-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1","name":"kibana-9.1","label":"kibana-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1","purlType":"apk","versions":[{"text":"< 9.1.10-r21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r21","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1-iamguarded","name":"kibana-9.1-iamguarded","label":"kibana-9.1-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1-iamguarded","purlType":"apk","versions":[{"text":"< 9.1.10-r21","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r21","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"< 9.2.8-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2-iamguarded","name":"kibana-9.2-iamguarded","label":"kibana-9.2-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2-iamguarded","purlType":"apk","versions":[{"text":"< 9.2.8-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.8-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"< 9.3.5-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.5-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3-iamguarded","name":"kibana-9.3-iamguarded","label":"kibana-9.3-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3-iamguarded","purlType":"apk","versions":[{"text":"< 9.3.5-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.5-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4","name":"kibana-9.4","label":"kibana-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4","purlType":"apk","versions":[{"text":"< 9.4.2-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4-iamguarded","name":"kibana-9.4-iamguarded","label":"kibana-9.4-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4-iamguarded","purlType":"apk","versions":[{"text":"< 9.4.2-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.2-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"node-gyp","name":"node-gyp","label":"node-gyp","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/node-gyp","purlType":"apk","versions":[{"text":"< 13.0.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.0.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"npm","name":"npm","label":"npm","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/npm","purlType":"apk","versions":[{"text":"< 11.17.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.17.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pelias-api","name":"pelias-api","label":"pelias-api","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pelias-api","purlType":"apk","versions":[{"text":"< 7.8.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.8.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"prism","name":"prism","label":"prism","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/prism","purlType":"apk","versions":[{"text":"< 5.15.11-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.15.11-r3","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"chainguard","product":"py3.10-captum","name":"py3.10-captum","label":"py3.10-captum","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.10-captum","purlType":"apk","versions":[{"text":"< 0.9.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.11-captum","name":"py3.11-captum","label":"py3.11-captum","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.11-captum","purlType":"apk","versions":[{"text":"< 0.9.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.12-captum","name":"py3.12-captum","label":"py3.12-captum","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.12-captum","purlType":"apk","versions":[{"text":"< 0.9.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"py3.13-captum","name":"py3.13-captum","label":"py3.13-captum","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/py3.13-captum","purlType":"apk","versions":[{"text":"< 0.9.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.9.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/renovate","purlType":"apk","versions":[{"text":"< 43.247.0-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 43.249.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.247.0-r0 | < 43.249.5-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"saf","name":"saf","label":"saf","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-24","name":"vitess-24","label":"vitess-24","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-24","purlType":"apk","versions":[{"text":"< 24.0.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.2-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"vitess-24-compat","name":"vitess-24-compat","label":"vitess-24-compat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/vitess-24-compat","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"wolfi","product":"code-server","name":"code-server","label":"code-server","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/code-server","purlType":"apk","versions":[{"text":"< 4.125.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.125.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"node-gyp","name":"node-gyp","label":"node-gyp","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/node-gyp","purlType":"apk","versions":[{"text":"< 13.0.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 13.0.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"npm","name":"npm","label":"npm","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/npm","purlType":"apk","versions":[{"text":"< 11.17.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 11.17.0-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"prism","name":"prism","label":"prism","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/prism","purlType":"apk","versions":[{"text":"< 5.15.11-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.15.11-r3","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"wolfi","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/renovate","purlType":"apk","versions":[{"text":"< 43.247.0-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 43.249.5-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.247.0-r0 | < 43.249.5-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"saf","name":"saf","label":"saf","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-24","name":"vitess-24","label":"vitess-24","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-24","purlType":"apk","versions":[{"text":"< 24.0.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.2-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"vitess-24-compat","name":"vitess-24-compat","label":"vitess-24-compat","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/vitess-24-compat","purlType":"apk","versions":[{"text":"< 24.0.3-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 24.0.3-r7","eol":null,"hubHref":null},{"vendor":"debian","product":"node-undici","name":"node-undici","label":"node-undici","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-undici","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 8.5.0+dfsg+~cs3.2.0-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 8.5.0+dfsg+~cs3.2.0-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-undici","name":"node-undici","label":"node-undici","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-undici","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"nodejs","product":"undici","name":"undici","label":"undici","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.27.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.28.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.5.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.27.0 | ≥ 7.0.0, < 7.28.0 | ≥ 8.0.0, < 8.5.0","eol":null,"hubHref":"/vendor/nodejs/undici"},{"vendor":"Npm","product":"undici","name":"undici","label":"undici","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/undici","purlType":"npm","versions":[{"text":"< 6.27.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.28.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.5.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.27.0 | ≥ 7.0.0, < 7.28.0 | ≥ 8.0.0, < 8.5.0","eol":null,"hubHref":null},{"vendor":"undici","product":"undici","name":"undici","label":"undici","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 6.26.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.0.0, < 7.28.0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 8.0.0, < 8.5.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 6.26.0 | ≥ 7.0.0, < 7.28.0 | ≥ 8.0.0, < 8.5.0","eol":null,"hubHref":"/vendor/undici/undici"}],"affectedCount":46,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv","label":"github.com/nodejs/undici/security/advisories/GHSA-p88m-4jfj-68fv","hostname":"github.com","tags":["REPORT","Advisory","WEB","Vendor Advisory","Mitigation"]},{"url":"https://cna.openjsf.org/security-advisories.html","label":"cna.openjsf.org/security-advisories.html","hostname":"cna.openjsf.org","tags":["Advisory","WEB","Vendor Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-9679","label":"ubuntu.com/security/CVE-2026-9679","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9679","label":"www.cve.org/CVERecord?id=CVE-2026-9679","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-9679","label":"security-tracker.debian.org/tracker/CVE-2026-9679","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9679.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9679.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9679","label":"nvd.nist.gov/vuln/detail/CVE-2026-9679","hostname":"nvd.nist.gov","tags":["Advisory","Oval"]},{"url":"https://github.com/nodejs/undici","label":"github.com/nodejs/undici","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:11121-1","OPENSUSE-SU-2026:21058-1","OPENSUSE-SU-2026:21236-1","RHSA-2026:38009","RHSA-2026:38236","SUSE-SU-2026:22368-1","SUSE-SU-2026:22565-1","SUSE-SU-2026:2633-1","SUSE-SU-2026:2647-1","SUSE-SU-2026:2695-1","SUSE-SU-2026:3929-1","SUSE-SU-2026:3930-1","SUSE-SU-2026:4248-1","SUSE-SU-2026:4261-1"],"duplicates":[],"related":["CGA-6XC8-HW7R-5CQW","OPENSUSE-SU-2026:11121-1","OPENSUSE-SU-2026:21058-1","OPENSUSE-SU-2026:21236-1","SUSE-SU-2026:22368-1","SUSE-SU-2026:22565-1","SUSE-SU-2026:2633-1","SUSE-SU-2026:2647-1","SUSE-SU-2026:2695-1","SUSE-SU-2026:3929-1","SUSE-SU-2026:3930-1","SUSE-SU-2026:4248-1","SUSE-SU-2026:4261-1"]},"timeline":[{"kind":"published","date":"2026-06-17T16:56:18.579Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-23T16:12:38.765Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":24,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T04:52:23.491Z","stale":false,"partial":false}}