CLEANSTART-2026-DQ76299: When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

Q: Which deployments are exposed?

Deployments using the listed cleanstart/kubernetes or cleanstart/argo-workflows packages may be affected if they run an HTTP server that accepts HTTP/1 CONNECT requests and has a handler that returns after sending a 2xx response without hijacking the connection.

Q: What does an attacker need to exploit this behavior?

The vector is network-based and requires no privileges or user interaction. The attacker needs to send an HTTP/1 CONNECT request that reaches a vulnerable server handler with the affected 2xx-response behavior.

Q: Is a default deployment necessarily affected?

The provided data does not establish that default configurations expose an affected CONNECT handler. Exposure depends on the server accepting HTTP/1 CONNECT requests and returning a 2xx response without hijacking the connection.

Q: How can I determine whether my service is affected?

Review HTTP/1 CONNECT handlers in deployments using the listed packages. A handler is in scope if it sends a 2xx response to CONNECT, returns normally, and does not hijack the connection.

Published Nov 11, 2026

Updated

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/kubernetes<1.34.11-r0

1.34.11-r0

cleanstart/kubernetes<1.34.13-r2

1.34.13-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.11-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-94439

Frequently Asked Questions

Which deployments are exposed?

Deployments using the listed cleanstart/kubernetes or cleanstart/argo-workflows packages may be affected if they run an HTTP server that accepts HTTP/1 CONNECT requests and has a handler that returns after sending a 2xx response without hijacking the connection.

What does an attacker need to exploit this behavior?

The vector is network-based and requires no privileges or user interaction. The attacker needs to send an HTTP/1 CONNECT request that reaches a vulnerable server handler with the affected 2xx-response behavior.

Is a default deployment necessarily affected?

The provided data does not establish that default configurations expose an affected CONNECT handler. Exposure depends on the server accepting HTTP/1 CONNECT requests and returning a 2xx response without hijacking the connection.

How can I determine whether my service is affected?

Review HTTP/1 CONNECT handlers in deployments using the listed packages. A handler is in scope if it sends a 2xx response to CONNECT, returns normally, and does not hijack the connection.

CLEANSTART-2026-DQ76299: When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this behavior?

Is a default deployment necessarily affected?

How can I determine whether my service is affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this behavior?

Is a default deployment necessarily affected?

How can I determine whether my service is affected?