CLEANSTART-2026-WZ95150: Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

Q: What access does an attacker need to exploit this issue?

The severity vector indicates network attack access, low attack complexity, and no required privileges or user interaction. An attacker would need to send a crafted multipart form request to a reachable affected component.

Q: What is the likely impact of successful exploitation?

The reported impact is availability only: an arbitrarily long line can be read into memory despite multipart memory limits. Confidentiality and integrity impacts are listed as none.

Q: When does the memory-limit bypass occur?

It occurs when parsing a multipart form and the remaining configured memory limit at the beginning of a part is less than 400 bytes. Under that condition, an arbitrarily long line may be loaded into memory.

Published Nov 12, 2026

Updated

Security vulnerability affects the zookeeper-operator package. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes.

Affected Software

1 affected componentFixes available

cleanstart/zookeeper-operator<0.1.1-r0

0.1.1-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/zookeeper-operator to a version that resolves this vulnerability.
Fixed in 0.1.1-r0

Event History

Nov 12, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-94440

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The severity vector indicates network attack access, low attack complexity, and no required privileges or user interaction. An attacker would need to send a crafted multipart form request to a reachable affected component.

What is the likely impact of successful exploitation?

The reported impact is availability only: an arbitrarily long line can be read into memory despite multipart memory limits. Confidentiality and integrity impacts are listed as none.

When does the memory-limit bypass occur?

It occurs when parsing a multipart form and the remaining configured memory limit at the beginning of a part is less than 400 bytes. Under that condition, an arbitrarily long line may be loaded into memory.

CLEANSTART-2026-WZ95150: Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

When does the memory-limit bypass occur?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

When does the memory-limit bypass occur?