CLEANSTART-2026-CR58561: Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...
Security vulnerability affects the zookeeper-operator package. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/zookeeper-operatorto a version that resolves this vulnerability.Fixed in 0.1.1-r0
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The severity vector indicates network-based exploitation with low attack complexity, requiring no privileges or user interaction. An attacker would need to send a specially crafted packet to a reachable affected server process.
What is the operational impact of a successful attack?
The reported impact is memory exhaustion in the server process, which can cause a denial of service. The vector assigns impact to availability only; no confidentiality or integrity impact is stated.