CLEANSTART-2026-PC03201: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request
Published Nov 12, 2026
·Updated
Security vulnerability affects the zookeeper-operator package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.
Affected Software
1 affected componentFixes available
cleanstart/zookeeper-operator<0.1.1-r0
0.1.1-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/zookeeper-operatorto a version that resolves this vulnerability.Fixed in 0.1.1-r0
Event History
Nov 12, 2026
Advisory Published
via OSV·12:36 AM
Data Sourced
via OSV·12:36 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The supplied severity vector indicates that it is exploitable remotely over the network, with low attack complexity. No privileges or user interaction are required.
2
What is the expected impact if exploitation succeeds?
The supplied severity vector indicates a high availability impact, while confidentiality and integrity impact are listed as none. The scope is unchanged.