Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

cleanstart/argo-cd may use excessive CPU on many range requests

published 9 days ago
Summary

The file‑serving functions used by the listed cleanstart products can spend a lot of processor time when a client asks for a large number of tiny portions of a file. This can slow down the application and waste resources. Update to the latest versions of the affected packages or configure the server to reject overly long Range headers to prevent the problem.

What to do
  • Update cleanstart cert-manager to version 1.18.6-r8.
  • Update cleanstart argo-cd to version 3.3.16-r1.
  • Update cleanstart argo-cd to version 3.4.11-r1.
  • Update cleanstart dex to version 2.43.1-r8.
  • Update cleanstart opa-fips to version 1.21.2-r2.
  • Update cleanstart kubernetes-csi-external-snapshotter to version 8.7.0-r0.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart cert-manager < 1.18.6-r8
Fix: upgrade to 1.18.6-r8
CleanStart cleanstart argo-cd < 3.3.16-r1
< 3.4.11-r1
Fix: upgrade to 3.3.16-r1
CleanStart cleanstart dex < 2.43.1-r8
Fix: upgrade to 2.43.1-r8
CleanStart cleanstart opa-fips < 1.21.2-r2
Fix: upgrade to 1.21.2-r2
CleanStart cleanstart kubernetes-csi-external-snapshotter < 8.7.0-r0
Fix: upgrade to 8.7.0-r0
Original advisory text
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU
CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published27 Oct 2026
Updated27 Oct 2026
First seen27 Oct 2026
Sources
CLEANSTART-2026-RU35739 · OSV
Track software like this
Free during beta