Bug 2510710 (CVE-2026-68945)

Summary: CVE-2026-68945 @angular/common: Angular: Cross-Request Response Reuse and State Poisoning in HttpTransferCache
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: amctagga, aoconnor, bniver, ewittman, flucifre, gmalinko, gmeno, gotiwari, gparvin, groman, janstey, jbalunas, jhorak, mbenjamin, mhackett, mvyas, nipatil, pantinor, pdelbell, rhaigner, rhel-process-autobot, rkubis, rstepani, sostapov, tsze, vereddy, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Angular's HttpTransferCache component. This component, used for caching HTTP requests during server-side rendering, incorrectly generates cache keys when repeated request parameters are present, causing semantically different requests to share the same cache key. This cache-key ambiguity can lead to cross-request response reuse and state poisoning, where a security-sensitive request might receive an incorrect or attacker-influenced cached response. This could result in an application displaying wrong information or operating with corrupted data, potentially leading to information disclosure.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2516193, 2516194, 2516197, 2516199, 2516192, 2516195, 2516196, 2516198, 2516200    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-03 17:01:52 UTC 
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19, and 22.0.2.