CLEANSTART-2026-AQ63247: attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing
Published Nov 7, 2026
·Updated
Security vulnerability affects the nginx-prometheus-exporter-fips package. An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.
Affected Software
1 affected componentFixes available
cleanstart/nginx-prometheus-exporter-fips<1.2.0-r0
1.2.0-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/nginx-prometheus-exporter-fipsto a version that resolves this vulnerability.Fixed in 1.2.0-r0
Event History
Nov 7, 2026
Advisory Published
via OSV·12:35 AM
Data Sourced
via OSV·12:35 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What must an attacker be able to do to trigger the issue?
The attacker must be able to supply a malicious malformed token to the affected parser.
2
What is the practical impact of successful exploitation?
Processing the malformed token can cause unexpected memory consumption during parsing, which may affect service availability.
3
How can I determine whether my deployment is affected?
Check whether you use the cleanstart/nginx-prometheus-exporter-fips package and whether untrusted parties can provide tokens that it parses.