Homepage

HTTP Response Splitting Affecting kibana-8.18-oci-entrypoint package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.24% (47th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-KIBANA818OCIENTRYPOINT-16044367
  • published14 Apr 2026
  • disclosed10 Apr 2026
Report a new vulnerability Found a mistake?

Introduced: 10 Apr 2026

NewCVE-2026-40175  (opens in a new tab)
CWE-113  (opens in a new tab)
CWE-444  (opens in a new tab)
CWE-918  (opens in a new tab)

How to fix?

There is no fixed version for Minimos:latest kibana-8.18-oci-entrypoint.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kibana-8.18-oci-entrypoint package and not the kibana-8.18-oci-entrypoint package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.3.1, the Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass). This vulnerability is fixed in 1.15.0 and 0.3.1.