CLEANSTART-2026-KO64094: When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...
Security vulnerability affects the trust-manager package. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/trust-managerto a version that resolves this vulnerability.Fixed in 0.25.0-r1
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to send HTTP/1 CONNECT requests to an affected server and receive a 2xx response from a handler that returns without hijacking the connection. No authentication or user interaction is required according to the supplied severity vector.
What is the likely impact?
The issue can allow continued request reading and serving on a connection after the CONNECT handler has returned. The supplied vector indicates high confidentiality impact, with no stated integrity or availability impact.
Are default deployments affected?
The provided information does not establish whether a default trust-manager deployment exposes an HTTP server handler with this CONNECT behavior. Exposure depends on whether the deployed server accepts HTTP/1 CONNECT requests and has a handler that returns a 2xx response without hijacking the connection.
How can I determine whether my deployment is exposed?
Review HTTP/1 server handlers associated with the deployment for CONNECT handling. Affected behavior is present when a handler sends a 2xx CONNECT response and returns without hijacking the connection.