CLEANSTART-2026-XV44707: HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Q: What does an attacker need to do to exploit this issue?

An attacker can exploit it remotely over HTTP/2 without authentication or user interaction. The issue is triggered by resetting a stream and having the request handler read buffered data, causing connection-level flow-control credit to be refunded twice.

Q: What is the likely security impact?

The provided severity vector indicates high impact to integrity and availability, with no confidentiality impact. The issue is rated critical with a CVSS score of 9.1.

Q: How can I tell whether an environment may be affected?

An environment may be affected if it uses the cleanstart/rabbitmq-cluster-operator package and exposes an HTTP/2 server path. The supplied data does not identify affected or fixed package versions.

Published Nov 3, 2026

Updated

Security vulnerability affects the rabbitmq-cluster-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data.

Affected Software

1 affected componentFixes available

cleanstart/rabbitmq-cluster-operator<2.23.2-r1

2.23.2-r1

Event History

Nov 3, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-78663

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

An attacker can exploit it remotely over HTTP/2 without authentication or user interaction. The issue is triggered by resetting a stream and having the request handler read buffered data, causing connection-level flow-control credit to be refunded twice.

What is the likely security impact?

The provided severity vector indicates high impact to integrity and availability, with no confidentiality impact. The issue is rated critical with a CVSS score of 9.1.

How can I tell whether an environment may be affected?

An environment may be affected if it uses the cleanstart/rabbitmq-cluster-operator package and exposes an HTTP/2 server path. The supplied data does not identify affected or fixed package versions.

CLEANSTART-2026-XV44707: HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

What is the likely security impact?

How can I tell whether an environment may be affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to do to exploit this issue?

What is the likely security impact?

How can I tell whether an environment may be affected?