CLEANSTART-2026-UI32764: When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...
Security vulnerability affects the zookeeper-operator package. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/zookeeper-operatorto a version that resolves this vulnerability.Fixed in 0.1.1-r0
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An HTTP/1 CONNECT request must reach a server handler that sends a 2xx response and then returns without hijacking the connection. The server then continues reading and serving requests on that connection.
Does exploitation require authentication or user interaction?
No. The supplied severity vector identifies network attack access, low attack complexity, no privileges required, and no user interaction.
What security impact is identified?
The supplied vector rates confidentiality impact as high, while integrity and availability impacts are listed as none.