CLEANSTART-2026-IT15296: For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in th...
CVE-2026-97054 affects multiple packages. For HTTP/1 servers, when MaxBytesReader's limit is exceeded, "Connection: close" header is automatically set without synchronization, which might race with another header being set explicitly in the server handler. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/knative-servingto a version that resolves this vulnerability.Fixed in 1.22.1-r12 - Upgrade
Upgrade
cleanstart/knative-servingto a version that resolves this vulnerability.Fixed in 1.23.0-r7 - Upgrade
Upgrade
cleanstart/knative-servingto a version that resolves this vulnerability.Fixed in 1.24.0-r2 - Upgrade
Upgrade
cleanstart/kube-state-metricsto a version that resolves this vulnerability.Fixed in 2.17.0-r13 - Upgrade
Upgrade
cleanstart/knative-net-istioto a version that resolves this vulnerability.Fixed in 1.24.0-r2 - Upgrade
Upgrade
cleanstart/knative-servingto a version that resolves this vulnerability.Fixed in 1.21.3-r9 - Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.1.0-r6 - Upgrade
Upgrade
cleanstart/kedato a version that resolves this vulnerability.Fixed in 2.20.2-r7 - Upgrade
Upgrade
cleanstart/resticto a version that resolves this vulnerability.Fixed in 0.18.1-r14 - Upgrade
Upgrade
cleanstart/wait-for-portto a version that resolves this vulnerability.Fixed in 1.0.10-r9
Event History
Frequently Asked Questions
Which listed components should be reviewed for exposure?
The affected software list includes cleanstart/knative-serving, cleanstart/kube-state-metrics, cleanstart/knative-net-istio, cleanstart/rundeck, cleanstart/keda, cleanstart/restic, and cleanstart/wait-for-port.
What conditions are required for the race to occur?
The issue applies to HTTP/1 servers when a MaxBytesReader limit is exceeded while the server handler explicitly sets another header. The automatic setting of the Connection: close header is unsynchronized and may race with that handler activity.