CLEANSTART-2026-DR50830: Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

Q: Does exploitation require authentication or user interaction?

No. The vector is network-accessible, requires no privileges, and requires no user interaction.

Q: What is the primary security impact?

The reported impact is on availability. Confidentiality and integrity impacts are listed as none, while availability impact is high.

Q: Which tracked software is affected?

The affected software listed for this advisory is cleanstart/kubernetes and cleanstart/argo-workflows.

Published Nov 11, 2026

Updated

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/kubernetes<1.34.11-r0

1.34.11-r0

cleanstart/kubernetes<1.34.13-r2

1.34.13-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.11-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-94440

Frequently Asked Questions

Does exploitation require authentication or user interaction?

No. The vector is network-accessible, requires no privileges, and requires no user interaction.

What is the primary security impact?

The reported impact is on availability. Confidentiality and integrity impacts are listed as none, while availability impact is high.

Which tracked software is affected?

The affected software listed for this advisory is cleanstart/kubernetes and cleanstart/argo-workflows.

CLEANSTART-2026-DR50830: Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the primary security impact?

Which tracked software is affected?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What is the primary security impact?

Which tracked software is affected?