Interpretation Conflict in undici - CVE-2026-14643
Published: July 29, 2026
Vulnerability identifier: #VU140033
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-14643
CWE-ID: CWE-436
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to interpretation conflict in the cache interceptor when processing Cache-Control directives with optional whitespace around the = character. A remote attacker can send requests that cause authenticated responses to be stored and later served to another caller to disclose sensitive information.
Only applications that explicitly enable shared cache mode, forward Authorization headers upstream, and receive cacheable responses with qualified private or no-cache directives are vulnerable.
Affected software
undici
IBM Maximo Application Suite
Netezza Appliance - Cyclops
IBM Maximo Application Suite
Netezza Appliance - Cyclops
How to mitigate CVE-2026-14643
Install security update from vendor's website.
undici - addressed in versions 7.29.0, 8.9.0
IBM Maximo Application Suite - addressed in versions 9.0.29, 9.1.21, 9.2.2
Netezza Appliance - Cyclops - update to 11.3.1.4
IBM Maximo Application Suite - addressed in versions 9.0.29, 9.1.21, 9.2.2
Netezza Appliance - Cyclops - update to 11.3.1.4