CVE-2026-1526 is a vulnerability in the undici WebSocket client used by Red Hat OpenShift Pipelines Operator (versions >=1.20.0 <1.20.5). The flaw involves the permessage-deflate decompression mechanism, which does not properly limit the size of decompressed data. An attacker can exploit this by sending a specially crafted compressed frame known as a decompression bomb, leading to unbounded memory consumption. This resource exhaustion can cause the Node.js process to crash or become unresponsive, resulting in a denial of service. Red Hat has not provided an official fix or mitigation that meets their criteria for ease of use, applicability, or stability as of the advisory date.

The vulnerability allows remote attackers to cause a denial of service by exhausting memory resources of the Node.js process running the OpenShift Pipelines Operator. This can lead to process crashes or unresponsiveness, impacting availability. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been reported at this time.

Currently, no official fix or mitigation meeting Red Hat Product Security criteria is available. Users should monitor Red Hat advisories for updates. Applying mitigations that do not meet Red Hat's standards is not recommended. Consider upgrading to a fixed version once available.