CLEANSTART-2026-UY42876: malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW...
Security vulnerability affects the zookeeper-operator package. A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/zookeeper-operatorto a version that resolves this vulnerability.Fixed in 0.1.1-r0
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The vulnerability is rated AV:N/AC:L/PR:N/UI:N, indicating it can be exploited remotely with low attack complexity, without privileges or user interaction.
Which HTTP/2 roles can be affected?
Both HTTP/2 clients and servers can be affected when they communicate with a malicious HTTP/2 peer.
What is the expected security impact?
The stated impact is high availability impact from excessive CPU consumption. No confidentiality or integrity impact is identified.