Allocation of Resources Without Limits or Throttling in axios - CVE-2026-67317

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU136915

Allocation of Resources Without Limits or Throttling in axios - CVE-2026-67317

Published: July 6, 2026 / Updated: September 14, 2026


Vulnerability identifier: #VU136915
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67317
CWE-ID: CWE-770
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause resource consumption and exhaust upstream quotas or bandwidth.

The vulnerability exists due to allocation of resources without limits or throttling in the fetch adapter when processing attacker-controlled unknown-length WHATWG ReadableStream request bodies. A remote attacker can supply a specially crafted streamed request body to cause resource consumption and exhaust upstream quotas or bandwidth.

Exploitation requires an application to use the fetch adapter, set a finite maxBodyLength value, and pass attacker-controlled stream data without a reliable Content-Length.


Affected software

axios
IBM Fusion HCI
IBM Watson Discovery for IBM Cloud Pak for Data
InfoSphere Optim Archive Viewer
Data Cataloging
QRadar Threat Intelligence
QRadar Deployment Intelligence App

How to mitigate CVE-2026-67317

Install security update from vendor's website.

axios - update to 1.18.0
IBM Fusion HCI - update to 2.14.0
InfoSphere Optim Archive Viewer - update to 11.7.0.15
Data Cataloging - update to 2.5.6
QRadar Threat Intelligence - update to 2.6.0
QRadar Deployment Intelligence App - update to 3.0.20
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.4.2

External References

Related Security Bulletins