CLEANSTART-2026-YI51495: HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
Published Nov 14, 2026
·Updated
Security vulnerability affects the yunikorn-k8shim package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data.
Affected Software
1 affected componentFixes available
cleanstart/yunikorn-k8shim<1.9.0-r1
1.9.0-r1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/yunikorn-k8shimto a version that resolves this vulnerability.Fixed in 1.9.0-r1
Event History
Nov 14, 2026
Advisory Published
via OSV·12:35 AM
Data Sourced
via OSV·12:35 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The vulnerability is remotely reachable over the network and requires no privileges or user interaction, according to the supplied CVSS vector.
2
What is the expected security impact?
The supplied CVSS vector indicates high impact to integrity and availability, with no confidentiality impact.