Skip to content
VulniPulse
Sign in
Highest advisory severityMedium 1 vendor · 1 advisory

CVE-2026-67317

CVE-2026-67317: 1 tracked advisory record across Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Red Hat

1 advisory
  • Advisory severityMedium5.3

    Medium [CVE-2026-67317] Denial of Service via maxBodyLength bypass with ReadableStream

    CVE-2026-67317Source published Source updated

    axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion. A flaw was found in axios. This can lead to uncontrolled network egress or resource exhaustion, resulting in a Denial of Service (DoS) for the affected system. Moderate: This flaw in `axios` allows for a denial of service by bypassing `maxBodyLength` enforcement. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-770. Affected Red Hat products: Red Hat Hardened Images; Migration Toolkit for Applications 8; Migration Toolkit for…

    Affected products in this advisory
    • Red Hat Hardened Images
    • Migration Toolkit for Applications 8
    • Migration Toolkit for Containers
    • Multicluster Engine for Kubernetes

    16 more entries in the full advisory.

    Source-reported affected versions
    • < 1.7.0
    • < 1.18.0
    Source-reported fixed versions
    • grafana13-1-main-13.1.1-0.5.hum1
    • grafana13-1-main-13.1.1-0.5.2.hum1
    • RHSA-2026:49714
    • RHSA-2026:50826
    Mitigation guidance
    • To mitigate this issue, applications using `axios` in Node.js environments should configure `axios` to use the HTTP adapter for untrusted stream uploads. Alternatively, implement application-layer logic to wrap and count stream data, aborting the upload if it exceeds the intended size limit.
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features