CLEANSTART-2026-UR29764: malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Q: Who can exploit this issue?

A malicious HTTP/2 peer can exploit it remotely. The supplied vector indicates no privileges or user interaction are required.

Q: What is the operational impact?

An attacker can cause excessive CPU consumption in an affected HTTP/2 client or server, potentially resulting in a denial of service. The supplied impact vector identifies availability as affected, with no stated confidentiality or integrity impact.

Q: What attack behavior should defenders look for?

Look for HTTP/2 peers opening large numbers of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. This pattern may be accompanied by unusually high CPU utilization in the affected client or server.

Published Nov 3, 2026

Updated

Security vulnerability affects the rabbitmq-cluster-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values.

Affected Software

1 affected componentFixes available

cleanstart/rabbitmq-cluster-operator<2.23.2-r1

2.23.2-r1

Event History

Nov 3, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-78669

Frequently Asked Questions

Who can exploit this issue?

A malicious HTTP/2 peer can exploit it remotely. The supplied vector indicates no privileges or user interaction are required.

What is the operational impact?

An attacker can cause excessive CPU consumption in an affected HTTP/2 client or server, potentially resulting in a denial of service. The supplied impact vector identifies availability as affected, with no stated confidentiality or integrity impact.

What attack behavior should defenders look for?

Look for HTTP/2 peers opening large numbers of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values. This pattern may be accompanied by unusually high CPU utilization in the affected client or server.

CLEANSTART-2026-UR29764: malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact?

What attack behavior should defenders look for?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the operational impact?

What attack behavior should defenders look for?