CLEANSTART-2026-TX75545: Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents
Security vulnerability affects the miniforge3 package. Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 26.3.2.3-r6
Frequently Asked Questions
What must an attacker be able to do to trigger this issue?
An attacker would need to provide an HTTP response whose body or chunk metadata contains non-hexadecimal or negative integer values. Successful exploitation also requires user interaction and high privileges, according to the supplied severity vector.
What is the likely security impact?
The stated impact is misinterpretation of HTTP response contents during response-body or chunk parsing. The supplied vector indicates no direct impact to confidentiality, integrity, or availability of the vulnerable component, but a low subsequent-system integrity impact is recorded.
How can I determine whether my environment is affected?
Check whether miniforge3 is installed or used in the affected workflow, then determine whether it processes HTTP responses that could contain malformed chunk or body length values. No affected or fixed package versions are provided in the available data.