CLEANSTART-2026-FS91009: For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in th...
Published Nov 14, 2026
·Updated
Security vulnerability affects the yunikorn-k8shim package. For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler.
Affected Software
2 affected componentsFixes available
cleanstart/yunikorn-k8shim<1.8.0-r5
1.8.0-r5
cleanstart/yunikorn-k8shim<1.9.0-r2
1.9.0-r2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/yunikorn-k8shimto a version that resolves this vulnerability.Fixed in 1.8.0-r5 - Upgrade
Upgrade
cleanstart/yunikorn-k8shimto a version that resolves this vulnerability.Fixed in 1.9.0-r2