CLEANSTART-2026-JO41196: malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Q: Which deployments are most exposed?

Deployments of cleanstart/kubernetes, cleanstart/gitea, cleanstart/kyverno, or cleanstart/argo-workflows are exposed when they operate as an HTTP/2 client or server and can communicate with a malicious HTTP/2 peer.

Q: What does an attacker need to exploit this issue?

The attacker needs to act as an HTTP/2 peer and open many streams before sending numerous small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. The supplied vector indicates exploitation does not require privileges or user interaction.

Published Nov 11, 2026

Updated

CVE-2026-78669 affects multiple packages. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values. See references for individual vulnerability details.

Affected Software

5 affected componentsFixes available

cleanstart/gitea<1.26.4-r6

1.26.4-r6

cleanstart/kubernetes<1.34.11-r0

1.34.11-r0

cleanstart/kubernetes<1.34.13-r0

1.34.13-r0

cleanstart/kyverno<1.19.2-r1

1.19.2-r1

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/gitea to a version that resolves this vulnerability.
Fixed in 1.26.4-r6
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.11-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/kyverno to a version that resolves this vulnerability.
Fixed in 1.19.2-r1
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-78669

Frequently Asked Questions

Which deployments are most exposed?

Deployments of cleanstart/kubernetes, cleanstart/gitea, cleanstart/kyverno, or cleanstart/argo-workflows are exposed when they operate as an HTTP/2 client or server and can communicate with a malicious HTTP/2 peer.

What does an attacker need to exploit this issue?

The attacker needs to act as an HTTP/2 peer and open many streams before sending numerous small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. The supplied vector indicates exploitation does not require privileges or user interaction.

CLEANSTART-2026-JO41196: malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are most exposed?

What does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed?

What does an attacker need to exploit this issue?