CLEANSTART-2026-MX71962: HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
Security vulnerability affects the zookeeper-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/zookeeper-operatorto a version that resolves this vulnerability.Fixed in 0.1.1-r0
Event History
Frequently Asked Questions
What level of access does an attacker need?
The vulnerability is network-accessible and requires no privileges or user interaction, as reflected by AV:N, PR:N, and UI:N.
What conditions are required to trigger the issue?
The affected service must be handling HTTP/2. An attacker must reset a stream with sent-but-unread data, and the request handler must subsequently read the buffered data, causing the connection-level flow-control credit to be refunded twice.
What is the potential security impact?
The vulnerability is rated critical with a 9.1 severity score and has high integrity and availability impact in the supplied vector. No confidentiality impact is indicated.