CLEANSTART-2026-VH04475: HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Q: Which deployments are potentially exposed?

Deployments using the listed cleanstart Kubernetes, Gitea, Kyverno, or Argo Workflows packages are potentially affected. The provided data does not identify affected or fixed package versions.

Q: What does an attacker need to do to trigger the issue?

An attacker needs network access to an affected HTTP/2 server and can trigger the condition without privileges or user interaction. The issue involves resetting a stream while the server has sent-but-unread request data that a handler later reads.

Q: What is the likely impact?

The vulnerability can compromise integrity and availability through double refunding of connection-level flow-control credit. The supplied severity vector indicates no confidentiality impact.

Q: How can I determine whether I am affected?

Identify whether the deployment includes one of the listed packages and accepts HTTP/2 server connections. Consult the referenced package-specific vulnerability details to determine version-level exposure, since those versions are not included in the provided data.

Published Nov 11, 2026

Updated

CVE-2026-78663 affects multiple packages. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. See references for individual vulnerability details.

Affected Software

5 affected componentsFixes available

cleanstart/gitea<1.26.4-r6

1.26.4-r6

cleanstart/kubernetes<1.34.11-r0

1.34.11-r0

cleanstart/kubernetes<1.34.13-r0

1.34.13-r0

cleanstart/kyverno<1.19.2-r1

1.19.2-r1

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/gitea to a version that resolves this vulnerability.
Fixed in 1.26.4-r6
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.11-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r0
Upgrade
Upgrade cleanstart/kubernetes to a version that resolves this vulnerability.
Fixed in 1.34.13-r2
Upgrade
Upgrade cleanstart/kyverno to a version that resolves this vulnerability.
Fixed in 1.19.2-r1
Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-78663

Frequently Asked Questions

Which deployments are potentially exposed?

Deployments using the listed cleanstart Kubernetes, Gitea, Kyverno, or Argo Workflows packages are potentially affected. The provided data does not identify affected or fixed package versions.

What does an attacker need to do to trigger the issue?

An attacker needs network access to an affected HTTP/2 server and can trigger the condition without privileges or user interaction. The issue involves resetting a stream while the server has sent-but-unread request data that a handler later reads.

What is the likely impact?

The vulnerability can compromise integrity and availability through double refunding of connection-level flow-control credit. The supplied severity vector indicates no confidentiality impact.

How can I determine whether I am affected?

Identify whether the deployment includes one of the listed packages and accepts HTTP/2 server connections. Consult the referenced package-specific vulnerability details to determine version-level exposure, since those versions are not included in the provided data.

CLEANSTART-2026-VH04475: HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are potentially exposed?

What does an attacker need to do to trigger the issue?

What is the likely impact?

How can I determine whether I am affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are potentially exposed?

What does an attacker need to do to trigger the issue?

What is the likely impact?

How can I determine whether I am affected?