CLEANSTART-2026-RK35937: When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU
Security vulnerability affects the trust-manager package. When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/trust-managerto a version that resolves this vulnerability.Fixed in 0.25.0-r1
Event History
Frequently Asked Questions
Who can exploit this issue?
The vector is network-accessible and requires no privileges or user interaction. An attacker able to send HTTP requests with crafted Range headers to an affected FileServer(FS), ServeContent, or ServeFile(FS) endpoint could trigger excessive CPU consumption.
What is the likely impact of a successful attack?
The stated impact is excessive CPU consumption, which can affect availability. The provided severity vector indicates no confidentiality or integrity impact.