undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields
CVE-2026-16729
Summary
Mariner
Products covered
azl3 httpd 2.4.68-1 on Azure Linux 3.0
azl3 azurelinux-image-tools 1.6.0-3 on Azure Linux 3.0
azl3 cert-manager 1.12.15-14 on Azure Linux 3.0
azl3 cf-cli 8.7.11-9 on Azure Linux 3.0
azl3 cloud-provider-kubevirt 0.5.1-9 on Azure Linux 3.0
azl3 containerd2 2.3.4-1 on Azure Linux 3.0
azl3 containerized-data-importer 1.62.0-8 on Azure Linux 3.0
azl3 coredns 1.11.4-21 on Azure Linux 3.0
Show 25 more products
azl3 cri-tools 1.32.0-8 on Azure Linux 3.0
azl3 docker-buildx 0.14.0-17 on Azure Linux 3.0
azl3 docker-compose 2.27.0-14 on Azure Linux 3.0
azl3 etcd 3.5.33-1 on Azure Linux 3.0
azl3 flannel 0.24.2-32 on Azure Linux 3.0
azl3 ignition-flatcar 2.22.0-6 on Azure Linux 3.0
azl3 kata-containers 4.1.0.kata0-1 on Azure Linux 3.0
azl3 kata-containers-cc 3.15.0.aks0-21 on Azure Linux 3.0
azl3 keda 2.14.1-19 on Azure Linux 3.0
azl3 kube-vip-cloud-provider 0.0.10-10 on Azure Linux 3.0
azl3 kubernetes 1.30.10-30 on Azure Linux 3.0
azl3 kubevirt 1.8.4-2 on Azure Linux 3.0
azl3 moby-containerd-cc 1.7.7-17 on Azure Linux 3.0
azl3 moby-engine 25.0.3-20 on Azure Linux 3.0
azl3 multus 4.0.2-11 on Azure Linux 3.0
azl3 opa 0.63.0-5 on Azure Linux 3.0
azl3 packer 1.9.5-21 on Azure Linux 3.0
azl3 prometheus-adapter 0.12.0-10 on Azure Linux 3.0
azl3 skopeo 1.14.4-13 on Azure Linux 3.0
azl3 telegraf 1.31.0-33 on Azure Linux 3.0
azl3 golang 1.26.7-1 on Azure Linux 3.0
azl3 golang 1.27.1-1 on Azure Linux 3.0
azl3 gcc 13.2.0-7 on Azure Linux 3.0
azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0
azl3 tensorflow 2.16.1-11 on Azure Linux 3.0
Remediation
Release Notes
Vendor-listed fixes
10.25.1-10
1.7.0-2
1.12.15-15
8.7.11-10
0.5.1-10
2.3.7-1
1.62.0-9
1.32.0-10
Show 18 more fixes
0.14.0-19
2.27.0-16
0.24.2-34
2.102.0-2
3.10.182-6
2.14.1-22
0.0.10-11
1.8.4-4
1.15.0-7
4.0.2-12
1.9.5-23
0.12.0-12
1.7.0-6
0.8.2-6
1.14.4-14
3.7.0-9
1.31.0-35
19.0.4-15
CVEs in this advisory 1
Update history
What changed in later vendor updates
SecurityAlert records field-level changes from the point we begin following a bulletin. Earlier vendor changes may not have a field-by-field record.
- Added fixed versions: 0.12.0-12, 1.8.4-4, 1.9.5-23, 2.3.7-1, 2.14.1-22.
- Added affected products: azl3 gcc 13.2.0-7 on Azure Linux 3.0, azl3 python-tensorboard 2.16.2-6 on Azure Linux 3.0, azl3 tensorflow 2.16.1-11 on Azure Linux 3.0.
- Added fixed versions: 0.0.10-11, 0.5.1-10, 0.8.2-6, 0.14.0-19, 0.24.2-34.
- Added affected products: azl3 golang 1.26.7-1 on Azure Linux 3.0, azl3 golang 1.27.1-1 on Azure Linux 3.0.
- Removed affected products: azl3 docker-cli 25.0.7-5 on Azure Linux 3.0, azl3 influxdb 2.7.5-21 on Azure Linux 3.0, azl3 libcontainers-common 20240213-3 on Azure Linux 3.0.
- Added fixed versions: 1.14.4-14, 1.31.0-35, 1.32.0-10, 3.7.0-9, 3.10.182-6.
- Added affected products: azl3 azurelinux-image-tools 1.6.0-3 on Azure Linux 3.0, azl3 cert-manager 1.12.15-14 on Azure Linux 3.0, azl3 cf-cli 8.7.11-9 on Azure Linux 3.0, azl3 cloud-provider-kubevirt 0.5.1-9 on Azure Linux 3.0, azl3 containerd2....
Updates
- Published by Microsoft Security Response Center
The publication date reported by the vendor.
- Added to SecurityAlert
We collected the advisory from the official source.
- Updated by Microsoft Security Response Center
The vendor changed the advisory after it was first published.
- Confirmed at the source
Our collector saw this advisory during a later source check.