CLEANSTART-2026-OR42651: malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
Published Nov 14, 2026
·Updated
Security vulnerability affects the yunikorn-k8shim package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values.
Affected Software
1 affected componentFixes available
cleanstart/yunikorn-k8shim<1.9.0-r1
1.9.0-r1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/yunikorn-k8shimto a version that resolves this vulnerability.Fixed in 1.9.0-r1
Event History
Nov 14, 2026
Advisory Published
via OSV·12:35 AM
Data Sourced
via OSV·12:35 AM
DescriptionSeverityAffected Software