Snyk Security Database

undici is an An HTTP/1.1 client, written from scratch for Node.js

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value via the fetch() function's Subresource Integrity verification logic, which splits the integrity string on a single space rather than on all ASCII whitespace characters. An integrity value whose digest is preceded by a horizontal tab or other non-space ASCII whitespace (e.g. \tsha256-...) is parsed as a single unrecognized token and skipped. When no recognized algorithm remains, the integrity list is treated as empty and the response is accepted unconditionally, allowing a server that returns a body different from the pinned digest to pass the check. An attacker who controls the response body can deliver arbitrary bytes to an application that uses whitespace-surrounded SRI metadata, with no integrity error raised.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the delete_asset_queued_events route in airflow/api_fastapi/core_api/routes/public/assets.py. An authenticated user with edit permission on one Dag and read access to others can delete the queued asset events of the read-only Dags and suppress their asset-triggered runs, because the asset-wide DELETE /assets/{asset_id}/queuedEvents route checks Dag-edit permission against a caller-supplied ?dag_id query value while deleting the queued events of every Dag the caller can read. The exposure is limited to deployments using asset-triggered scheduling where Dag read access is granted more widely than edit access, and the per-Dag /dags/{dag_id}/...queuedEvents routes are unaffected because their Dag id comes from the path.

Note: This is an incomplete fix of the vulnerability described in CVE-2026-75157.

org.apache.axis2:axis2-kernel is a Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in its WSDL and schema import resolution, in WSDLToAxisServiceBuilder.getXMLSchema and the AAR and WAR deployment URI resolvers. An attacker who controls a WSDL or schema processed by an Axis2 application can make the JVM send requests to arbitrary internal or external hosts by placing an absolute URL in a wsdl:import location or an xsd:import or xsd:include schemaLocation, which xmlschema-core's DefaultURIResolver follows with no scheme or host restriction. This is reached client-side when building a service from an untrusted WSDL through ServiceClient or AxisService.createClientSideAxisService, and server-side when deploying an AAR or WAR whose packaged schema names absolute locations.