CLEANSTART-2026-NH23437: Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Q: Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates network attackability with low attack complexity and no required privileges or user interaction.

Q: What security impact is indicated?

The supplied CVSS vector rates integrity impact as high, with no indicated confidentiality or availability impact.

Published Nov 3, 2026

Updated

Security vulnerability affects the rabbitmq-cluster-operator package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing.

Affected Software

1 affected componentFixes available

cleanstart/rabbitmq-cluster-operator<2.23.2-r1

2.23.2-r1

Event History

Nov 3, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-78660

Frequently Asked Questions

Does exploitation require authentication or user interaction?

The supplied CVSS vector indicates network attackability with low attack complexity and no required privileges or user interaction.

What security impact is indicated?

The supplied CVSS vector rates integrity impact as high, with no indicated confidentiality or availability impact.

CLEANSTART-2026-NH23437: Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What security impact is indicated?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require authentication or user interaction?

What security impact is indicated?