Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

cert-manager, helm, argo-cd, kyverno, dex accept malformed HTTP/2 headers

published 9 days ago
Summary

The listed cleanstart components use an HTTP/2 library that does not properly reject badly formed framing-related headers. While these headers cannot change the core data frames, they could still lead to unexpected server behavior or make it easier to exploit other weaknesses. Update to the latest versions of each product or apply any available patches that tighten header validation.

What to do
  • Update cleanstart cert-manager to version 1.18.6-r8.
  • Update cleanstart helm to version 4.3.1-r1.
  • Update cleanstart argo-cd to version 3.3.16-r3.
  • Update cleanstart argo-cd to version 3.4.11-r6.
  • Update cleanstart kyverno to version 1.18.2-r4.
  • Update cleanstart dex to version 2.43.1-r7.
  • Update cleanstart opa-fips to version 1.21.2-r2.
  • Update cleanstart kubernetes-csi-external-snapshotter to version 8.7.0-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart cert-manager < 1.18.6-r8
Fix: upgrade to 1.18.6-r8
CleanStart cleanstart helm < 4.3.1-r1
Fix: upgrade to 4.3.1-r1
CleanStart cleanstart argo-cd < 3.3.16-r3
< 3.4.11-r6
Fix: upgrade to 3.3.16-r3
CleanStart cleanstart kyverno < 1.18.2-r4
Fix: upgrade to 1.18.2-r4
CleanStart cleanstart dex < 2.43.1-r7
Fix: upgrade to 2.43.1-r7
CleanStart cleanstart opa-fips < 1.21.2-r2
Fix: upgrade to 1.21.2-r2
CleanStart cleanstart kubernetes-csi-external-snapshotter < 8.7.0-r0
Fix: upgrade to 8.7.0-r0
Original advisory text
Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing
CVE-2026-78660 affects multiple packages. Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CLEANSTART-2026-PB75330 · OSV
Track software like this
Free during beta