CLEANSTART-2026-ND67671: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Q: What access does an attacker need to exploit this issue?

The vulnerability is rated AV:N/AC:L/PR:N/UI:N, indicating that exploitation can be performed over the network with low attack complexity and does not require prior privileges or user interaction.

Q: What is the expected impact if exploitation succeeds?

The supplied vector indicates no confidentiality or integrity impact, but a high availability impact (C:N/I:N/A:H).

Q: How can I determine whether my deployment is affected?

Review whether your environment uses the cleanstart/rabbitmq-cluster-operator package. The provided information does not identify affected or fixed package versions, configurations, or detection indicators.

Published Nov 3, 2026

Updated

Security vulnerability affects the rabbitmq-cluster-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.

Affected Software

1 affected componentFixes available

cleanstart/rabbitmq-cluster-operator<2.23.2-r1

2.23.2-r1

Event History

Nov 3, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-78659

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The vulnerability is rated AV:N/AC:L/PR:N/UI:N, indicating that exploitation can be performed over the network with low attack complexity and does not require prior privileges or user interaction.

What is the expected impact if exploitation succeeds?

The supplied vector indicates no confidentiality or integrity impact, but a high availability impact (C:N/I:N/A:H).

How can I determine whether my deployment is affected?

Review whether your environment uses the cleanstart/rabbitmq-cluster-operator package. The provided information does not identify affected or fixed package versions, configurations, or detection indicators.

CLEANSTART-2026-ND67671: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected impact if exploitation succeeds?

How can I determine whether my deployment is affected?