CLEANSTART-2026-AX59419: HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
Security vulnerability affects the trust-manager package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/trust-managerto a version that resolves this vulnerability.Fixed in 0.25.0-r1
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable over the network and requires no privileges or user interaction.
What security impact can exploitation have?
The provided severity vector indicates high impact to integrity and availability, with no confidentiality impact.
Which component should be investigated?
Investigate deployments using the cleanstart/trust-manager package, particularly HTTP/2 server functionality that accepts client stream resets while request handlers may read buffered request data.