CLEANSTART-2026-KP28481: attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames

Q: What does an attacker need to exploit this issue?

The issue is remotely exploitable over the network with low attack complexity. It requires no authentication, privileges, or user interaction; the attacker sends an excessive number of HTTP/2 CONTINUATION frames to an affected endpoint.

Q: What is the likely impact of exploitation?

The documented impact is availability loss. An affected HTTP/2 endpoint may read arbitrary amounts of header data, which can exhaust resources and disrupt service.

Q: Are confidentiality or integrity impacts identified?

No. The provided vector identifies no confidentiality or integrity impact, while availability impact is rated high.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-45288

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue is remotely exploitable over the network with low attack complexity. It requires no authentication, privileges, or user interaction; the attacker sends an excessive number of HTTP/2 CONTINUATION frames to an affected endpoint.

What is the likely impact of exploitation?

The documented impact is availability loss. An affected HTTP/2 endpoint may read arbitrary amounts of header data, which can exhaust resources and disrupt service.

Are confidentiality or integrity impacts identified?

No. The provided vector identifies no confidentiality or integrity impact, while availability impact is rated high.

CLEANSTART-2026-KP28481: attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact of exploitation?

Are confidentiality or integrity impacts identified?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the likely impact of exploitation?

Are confidentiality or integrity impacts identified?