CLEANSTART-2026-SG18333: Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing

Q: Does an attacker need credentials or user interaction to exploit this issue?

No. The provided vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

Q: What is the expected security impact if exploitation succeeds?

The reported impact is high integrity impact. No confidentiality or availability impact is indicated, and the scope is unchanged.

Published Nov 14, 2026

Updated

Security vulnerability affects the yunikorn-k8shim package. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing.

Affected Software

1 affected componentFixes available

cleanstart/yunikorn-k8shim<1.9.0-r1

1.9.0-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/yunikorn-k8shim to a version that resolves this vulnerability.
Fixed in 1.9.0-r1

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-78660

Frequently Asked Questions

Does an attacker need credentials or user interaction to exploit this issue?

No. The provided vector indicates network-reachable exploitation with low attack complexity, no privileges required, and no user interaction required.

What is the expected security impact if exploitation succeeds?