CVE-2026-109855Suited to automated attack · CISA
undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
CVSS score
7.5
EPSS probability
%0.3
Risk score
0.0
Published
17 h ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
No verified public exploit code was found.
GitHub repositories, NVD exploit references and the Metasploit Framework were scanned. A record of active exploitation does not mean that public exploit code has been published.
Similar Vulnerabilities
7.5
CVE-2026-87018
undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
U
Patch status unknown
7.5
CVE-2026-109869
undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
U
Patch status unknown
7.4
CVE-2026-109383
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
U
Patch status unknown
7.4
CVE-2026-109829
undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
U
Patch status unknown
5.9
CVE-2026-87029
undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
U
Patch status unknown
5.9
CVE-2026-109932
undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
U
Patch status unknown
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-109855"