CLEANSTART-2026-SN80404: When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request
Published Nov 14, 2026
·Updated
Security vulnerability affects the yunikorn-k8shim package. When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.
Affected Software
1 affected componentFixes available
cleanstart/yunikorn-k8shim<1.9.0-r1
1.9.0-r1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/yunikorn-k8shimto a version that resolves this vulnerability.Fixed in 1.9.0-r1
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The reported vector is network-based. Exploitation requires no prior privileges and no user interaction.
2
What is the expected security impact?
The vulnerability is rated high severity with a 7.5 score and is assessed as having high availability impact. The supplied vector indicates no confidentiality or integrity impact.