CLEANSTART-2026-HY07115: Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

Q: What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely by sending a well-crafted packet containing multiple ECH outer extension references. No privileges or user interaction are required.

Q: What is the expected impact of successful exploitation?

Successful exploitation can trigger memory exhaustion in the server process, resulting in a denial-of-service condition. The provided severity vector indicates no stated confidentiality or integrity impact.

Q: Which listed software should be investigated?

The affected software list includes cleanstart/kubernetes and cleanstart/argo-workflows. The advisory states that CVE-2026-97031 affects multiple packages, but does not provide affected versions or configuration details.

Published Nov 11, 2026

Updated

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/kubernetes<1.34.11-r0

1.34.11-r0

cleanstart/kubernetes<1.34.13-r2

1.34.13-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.11-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97031

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker can exploit the issue remotely by sending a well-crafted packet containing multiple ECH outer extension references. No privileges or user interaction are required.

What is the expected impact of successful exploitation?

Successful exploitation can trigger memory exhaustion in the server process, resulting in a denial-of-service condition. The provided severity vector indicates no stated confidentiality or integrity impact.

Which listed software should be investigated?

The affected software list includes cleanstart/kubernetes and cleanstart/argo-workflows. The advisory states that CVE-2026-97031 affects multiple packages, but does not provide affected versions or configuration details.

CLEANSTART-2026-HY07115: Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected impact of successful exploitation?

Which listed software should be investigated?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected impact of successful exploitation?

Which listed software should be investigated?