CLEANSTART-2026-SS27687: Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Q: Which deployments should be prioritized for triage?

Prioritize deployments using cleanstart/kubernetes or cleanstart/argo-workflows, as these are the affected packages identified in the advisory.

Q: What level of attacker access is required to exploit this issue?

The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction required. Successful exploitation can affect availability through stack exhaustion.

Q: What is the expected security impact?

The reported impact is availability only: the CVSS vector lists no confidentiality or integrity impact and high availability impact. The depth counter may not fire because DecodeElement resets it, allowing stack exhaustion.

Published Nov 11, 2026

Updated

CVE-2026-56859 affects multiple packages. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/kubernetes<1.34.13-r2

1.34.13-r2

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:40 AM

Data Sourced

via OSV·12:40 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-56859

Frequently Asked Questions

Which deployments should be prioritized for triage?

Prioritize deployments using cleanstart/kubernetes or cleanstart/argo-workflows, as these are the affected packages identified in the advisory.

What level of attacker access is required to exploit this issue?

The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction required. Successful exploitation can affect availability through stack exhaustion.

What is the expected security impact?

The reported impact is availability only: the CVSS vector lists no confidentiality or integrity impact and high availability impact. The depth counter may not fire because DecodeElement resets it, allowing stack exhaustion.

CLEANSTART-2026-SS27687: Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for triage?

What level of attacker access is required to exploit this issue?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for triage?

What level of attacker access is required to exploit this issue?

What is the expected security impact?