Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
Renovate may mix response data on retry
published 4 days ago
Summary
Renovate's retry feature can combine parts of a server's reply with data from a later retry, causing the final response to contain extra or corrupted information while still showing the original status and headers. This can lead to incorrect data being processed by your applications. Update Renovate to the latest version that fixes the retry handling or disable the retry interceptor until the fix is applied.
What to do
- Update cleanstart renovate to version 44.154.1-r1.
- Update cleanstart renovate to version 44.152.0-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | renovate |
< 44.154.1-r1 < 44.152.0-r2 Fix: upgrade to 44.154.1-r1
|
Original advisory text
undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers
CVE-2026-18540 affects multiple packages. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLEANSTART-2026-ZP07254 · OSV
Track software like this
Free during beta