CLEANSTART-2026-NW77490: HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Q: Which deployments should be prioritized for assessment?

Assess deployments using cleanstart/kubernetes, cleanstart/gitea, cleanstart/kyverno, or cleanstart/argo-workflows, as these are the software packages listed for this CVE.

Q: Does the available information identify authentication, network access, or configuration prerequisites for exploitation?

No. The supplied data identifies concurrent modification of an HTTP/2 HPACK encoder as the crash condition, but does not specify authentication requirements, exposure conditions, or whether default configurations are affected.

Published Nov 11, 2026

Updated

CVE-2026-97032 affects multiple packages. HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. See references for individual vulnerability details.

Affected Software

5 affected componentsFixes available

cleanstart/gitea<1.26.4-r6

1.26.4-r6

cleanstart/kubernetes<1.34.11-r0

1.34.11-r0

cleanstart/kubernetes<1.34.13-r0

1.34.13-r0

cleanstart/kyverno<1.19.2-r1

1.19.2-r1

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/gitea to a version that resolves this vulnerability.
Fixed in 1.26.4-r6
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.11-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/kyverno to a version that resolves this vulnerability.
Fixed in 1.19.2-r1
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-97032

Frequently Asked Questions

Which deployments should be prioritized for assessment?

Assess deployments using cleanstart/kubernetes, cleanstart/gitea, cleanstart/kyverno, or cleanstart/argo-workflows, as these are the software packages listed for this CVE.

Does the available information identify authentication, network access, or configuration prerequisites for exploitation?

No. The supplied data identifies concurrent modification of an HTTP/2 HPACK encoder as the crash condition, but does not specify authentication requirements, exposure conditions, or whether default configurations are affected.

CLEANSTART-2026-NW77490: HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for assessment?

Does the available information identify authentication, network access, or configuration prerequisites for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for assessment?

Does the available information identify authentication, network access, or configuration prerequisites for exploitation?