agentjido CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL agentjido CVE published 2026-10-23

CVE-2026-107685

CVE-2026-107685 Improper Certificate Validation vulnerability in req_llm allows on-path attackers to read and modify OpenAI WebSocket sessions. The vulnerability affects req_llm versions from 1.9.0 before 1.29.0. Defenders should assess exposure and prioritize verification and remediation. The vulnerability is caused by the WebSocket streaming client in agentjido req_llm not trusting TLS certificates, all [truncated]