CVE-2026-9675 describes a denial of service vulnerability in the undici HTTP client's WebSocket implementation. The flaw arises from unbounded accumulation of fragmented WebSocket frames, allowing a malicious server to cause memory exhaustion in the client. This vulnerability was introduced in undici version 8.0.0 and affects versions up to 8.4.x. Red Hat products bundle undici versions 5.x, 6.x, and 7.x, which do not include the vulnerable code path. Red Hat rates this issue as Moderate (CVSS 5.9) due to the requirement that the client connects to an attacker-controlled WebSocket server, which is unlikely in typical Red Hat deployments. No Red Hat product is affected. Users with manually installed undici 8.x should upgrade to 8.5.0 or later to resolve the vulnerability.

Successful exploitation allows a malicious WebSocket server to cause unbounded memory growth in the client process, resulting in memory exhaustion and denial of service. The impact is limited to denial of service without confidentiality or integrity loss. Red Hat products are not affected as they ship non-vulnerable undici versions. The attack requires connection to an attacker-controlled WebSocket server, which is unlikely in typical Red Hat environments.

No action is required for Red Hat products as they do not include the vulnerable undici versions. Users who have manually installed undici 8.x outside of Red Hat packages should upgrade to undici version 8.5.0 or later to fully resolve the issue.