Bug 2447143 (CVE-2026-2229)

Summary:	CVE-2026-2229 undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abarbaro, alizardo, anpicker, asoldano, bbaranow, bmaxwell, bparees, brian.stansberry, cmah, darran.lofthouse, dosoudil, dschmidt, eaguilar, ebaron, erezende, fjuma, hasun, istudens, ivassile, iweiss, jchui, jfula, jhe, jkoehler, jlanda, jolong, jowilson, kshier, ktsao, lphiri, mosmerov, msvehla, nboldt, nwallace, nyancey, ometelka, pberan, pesilva, pjindal, pmackay, psrna, ptisnovs, rstancel, sdawley, simaishi, smaestri, smcdonal, stcannon, syedriko, teagle, tom.jenkinson, xdharmai, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client's Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2447159, 2447161, 2447163, 2447164
Bug Blocks:

Description OSIDB Bzimport 2026-03-12 21:01:52 UTC

ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits parameter in the permessage-deflate extension. When a WebSocket client connects to a server, it automatically advertises support for permessage-deflate compression. A malicious server can respond with an out-of-range server_max_window_bits value (outside zlib's valid range of 8-15). When the server subsequently sends a compressed frame, the client attempts to create a zlib InflateRaw instance with the invalid windowBits value, causing a synchronous RangeError exception that is not caught, resulting in immediate process termination.

The vulnerability exists because:

  *  The isValidClientWindowBits() function only validates that the value contains ASCII digits, not that it falls within the valid range 8-15
  *  The createInflateRaw() call is not wrapped in a try-catch block
  *  The resulting exception propagates up through the call stack and crashes the Node.js process

Comment 3 errata-xmlrpc 2026-04-08 13:54:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:7080 https://access.redhat.com/errata/RHSA-2026:7080

Comment 4 errata-xmlrpc 2026-04-08 18:04:49 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:7123 https://access.redhat.com/errata/RHSA-2026:7123

Comment 5 errata-xmlrpc 2026-04-09 12:47:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:7302 https://access.redhat.com/errata/RHSA-2026:7302

Comment 6 errata-xmlrpc 2026-04-09 13:19:54 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:7310 https://access.redhat.com/errata/RHSA-2026:7310

Comment 7 errata-xmlrpc 2026-04-09 20:20:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:7350 https://access.redhat.com/errata/RHSA-2026:7350

Comment 8 errata-xmlrpc 2026-04-13 02:23:02 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:7675 https://access.redhat.com/errata/RHSA-2026:7675

Comment 9 errata-xmlrpc 2026-04-13 02:47:28 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:7670 https://access.redhat.com/errata/RHSA-2026:7670

Comment 11 errata-xmlrpc 2026-04-14 06:52:03 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:7983 https://access.redhat.com/errata/RHSA-2026:7983

Comment 12 errata-xmlrpc 2026-05-26 03:53:48 UTC

This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2026:17789 https://access.redhat.com/errata/RHSA-2026:17789