CVE Intelligence
Skip to main content
HIGH

CVE-2026-44488

CVE-2026-44488 — Axios: Allocation of Resources Without Limits or Throttling in axios

Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usage when a malicious or compromised server returns an oversized response, when an attacker can supply a large data: URL, or when an application forwards attacker-controlled request bodies through axios while relying on maxBodyLength as a boundary. This vulnerability is fixed in 0.32.0 and 1.16.0.

Published Updated Sources: cvelistV5, GitHub_M

Triage

Is it exploited, how likely is exploitation, what does it touch, and how severe do the scoring sources call it.

Exploitation

Unreported

no source claims exploitation

EPSS

1%

chance of exploitation in 30 days

Affects

axios

68 products listed

CVSS base

7.5

HIGH

CISA SSVC assessment

Three decision points CISA publishes for the CVEs it assesses · SSVC 2.0.3. A stakeholder decision, not a severity score.

CISA

Exploitation

PoC

none · proof-of-concept · active

Automatable

Yes

can an attacker script all four kill-chain steps

Technical impact

Partial

partial · total control of the vulnerable component

Affected scope

The catalog records vendors and products as separate lists, not pairs, so which product belongs to which vendor is not something this page can say.

Vendors (2)

axiosredhat

Products (68)

axiosred hat amq broker 7 13 6red hat amq broker 7 14 1red hat ansible automation platform 2 5 for rhel 8red hat ansible automation platform 2 5 for rhel 9red hat ansible automation platform 2 6 for rhel 9red hat data grid 8 6 2multicluster engine for kubernetes 2 1multicluster engine for kubernetes 2 6multicluster engine for kubernetes 2 8multicluster engine for kubernetes 2 9red hat advanced cluster management for kubernetes 2 11red hat advanced cluster management for kubernetes 2 13red hat advanced cluster management for kubernetes 2 14red hat advanced cluster management for kubernetes 2 15red hat advanced cluster management for kubernetes 2 16red hat advanced cluster security 4 9red hat advanced cluster security for kubernetes 4 10red hat ansible automation platform 2 6red hat ansible automation platform 2 7red hat developer hub 1 10red hat developer hub 1 9red hat discovery 2red hat migration toolkit 1 8red hat migration toolkit for applications 8 1red hat openshift ai 3 4red hat openshift container platform 4 13red hat openshift container platform 4 14red hat openshift container platform 4 15red hat openshift container platform 4 16red hat openshift container platform 4 19red hat openshift container platform 4 20red hat openshift container platform 4 21red hat openshift container platform 4 22red hat openshift dev spaces 3 29red hat openshift service mesh 2 6red hat openshift service mesh 3 0red hat openshift service mesh 3 1red hat openshift service mesh 3 2red hat openshift service mesh 3 3red hat quay 3 10red hat quay 3 12red hat quay 3 15red hat quay 3 16red hat quay 3 9red hat satellite 6 19red hat trusted artifact signer 1 3cryostat 4gatekeeper 3migration toolkit for applications 8network observability operatoropenshift pipelinesopenshift service mesh 3red hat 3scale api management platform 2red hat ansible automation platform 2red hat build of apache camel for spring boot 4red hat build of apache camel hawtio 4red hat build of apicurio registry 3red hat build of podman desktop tech previewred hat enterprise linux 8red hat enterprise linux 9red hat enterprise linux ai rhel ai 3red hat fuse 7red hat openshift ai rhoaired hat openshift container platform 4red hat openshift virtualization 4red hat trusted profile analyzerself service automation portal 2

Every base score collected

Sources score independently and disagree; each row says who scored it and under which version.

ScoreVersionSeverityExpl.ImpactSource
7.5CVSS 3.1HIGH——cvelistV5

Weakness & attack patterns

  • CWE-770

Attack patterns reported against this CVE. The ATT&CK techniques below are inferred from its weakness class.

  • T1498.001Network Denial of Service: Direct Network Flood
  • T1499Endpoint Denial of Service
  • T1499.003Endpoint Denial of Service: Application Exhaustion Flood

References

25 on the record

Elsewhere on this site

  • axiosevery CVE for this vendor
  • redhatevery CVE for this vendor
  • CWE-770other pages naming this weakness

Not in any source we poll

Listed rather than left blank: an empty field and an unmeasured one look identical on screen, and only one is a reason to look elsewhere.

  • No confirmed IOCs, IP addresses, domains, file hashes, or malware artifacts supplied.
  • No organization-specific asset inventory, compensating-control status, or patch deployment evidence supplied.
  • No exploit packet captures, log samples, or incident case IDs supplied.