Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-08-01T12:22:16 axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-770

axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in the fetch adapter when Content-Length cannot be determined. Attackers can supply unknown-length stream data to bypass upload size limits and cause uncontrolled network egress or resource exhaustion.

A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to uncontrolled network egress or resource exhaustion, resulting in a Denial of Service (DoS) for the affected system.

Red Hat Hardened Images 2026-08-03T00:00:00Z RHSA-2026:49714 grafana13-1-main-13.1.1-0.5.hum1 Red Hat Hardened Images 2026-08-05T00:00:00Z RHSA-2026:50826 grafana13-1-main-13.1.1-0.5.2.hum1 Red Hat Hardened Images Not affected grafana12.4 Red Hat Hardened Images Not affected jaeger https://www.cve.org/CVERecord?id=CVE-2026-67317 https://nvd.nist.gov/vuln/detail/CVE-2026-67317 https://github.com/axios/axios/security/advisories/GHSA-jqh4-m9w3-8hp9 https://www.vulncheck.com/advisories/axios-before-maxbodylength-bypass-via-readablestream