Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
kube-logging-operator can double-count data causing resource waste
published 8 days ago
Summary
The logging operator’s HTTP/2 server can mistakenly refund the same data twice—once when a client aborts a request and again when the server reads the buffered data. This miscount can lead to inaccurate flow‑control handling, potentially degrading performance or exhausting resources. Update the operator to the latest version or apply the provided patch to correct the flow‑control logic.
What to do
- Update cleanstart kube-logging-operator to version 6.9.0-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | kube-logging-operator |
< 6.9.0-r0 Fix: upgrade to 6.9.0-r0
|
Original advisory text
HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a r...
Security vulnerability affects the kube-logging-operator package. The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published11 Oct 2026
Updated11 Oct 2026
First seen11 Oct 2026
Sources
CLEANSTART-2026-EN61439 · OSV
Track software like this
Free during beta