Medium [CVE-2026-67317] Denial of Service via maxBodyLength bypass with ReadableStream
This medium-severity Red Hat Linux advisory covers CVE-2026-67317 affecting Red Hat Hardened Images, Migration Toolkit for Applications 8, Migration Toolkit for Containers.
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Summary
axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.
A flaw was found in axios. This can lead to uncontrolled network egress or resource exhaustion, resulting in a Denial of Service (DoS) for the affected system.
Moderate: This flaw in `axios` allows for a denial of service by bypassing `maxBodyLength` enforcement. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Weakness: CWE-770.
Affected Red Hat products: Red Hat Hardened Images; Migration Toolkit for Applications 8; Migration Toolkit for Containers; Multicluster Engine for Kubernetes; Network Observability Operator; OpenShift Pipelines; OpenShift Service Mesh 3; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Advanced Cluster Security 4; Red Hat Ansible Automation Platform 2; Red Hat build of Apicurio Registry 3; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat OpenShift Virtualization 4; Red Hat Quay 3; Red Hat Satellite 6; Red Hat Trusted Profile Analyzer; Self-service automation portal 2.
- < 1.7.0
- < 1.18.0
Official advisory · high-confidence parse· fetched 5 days ago·verify at source
- grafana13-1-main-13.1.1-0.5.hum1
- grafana13-1-main-13.1.1-0.5.2.hum1
- RHSA-2026:49714
- RHSA-2026:50826
Official advisory · high-confidence parse· fetched 5 days ago·verify at source
Mitigation checklist
- To mitigate this issue, applications using `axios` in Node.js environments should configure `axios` to use the HTTP adapter for untrusted stream uploads. Alternatively, implement application-layer logic to wrap and count stream data, aborting the upload if it exceeds the intended size limit.
Official advisory · high-confidence parse· fetched 5 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.