CLEANSTART-2026-EY75832: malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
Security vulnerability affects the trust-manager package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/trust-managerto a version that resolves this vulnerability.Fixed in 0.25.0-r1
Event History
Frequently Asked Questions
Who can exploit this issue?
Any malicious HTTP/2 peer can trigger the excessive CPU consumption. The provided vector indicates network-based exploitation with low complexity, no privileges, and no user interaction required.
What does an attacker need to send?
The attacker needs to open a large number of HTTP/2 streams and send many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
What is the impact of successful exploitation?
Successful exploitation can cause excessive CPU consumption in either the HTTP/2 client or server, resulting in an availability impact. The provided severity vector indicates no confidentiality or integrity impact.