Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
stakater-reloader, kube-state-metrics, gomplate, loki, opa-fips may overload CPU
published 5 days ago
Summary
These Go-based components can use a lot of processor power when a web request asks for many tiny parts of a file (a large Range header). This can slow down your services or cause them to become unresponsive. Update to the latest releases or apply the vendor's patches, and consider limiting or validating Range requests to prevent the issue.
What to do
- Update cleanstart stakater-reloader to version 1.1.0-r6.
- Update cleanstart stakater-reloader to version 1.1.0-r7.
- Update cleanstart kube-state-metrics to version 2.20.0-r4.
- Update cleanstart gomplate to version 4.3.3-r5.
- Update cleanstart loki to version 3.5.12-r6.
- Update cleanstart opa-fips to version 1.21.2-r0.
- Update cleanstart istio-pilot-discovery to version 1.30.5-r0.
- Update cleanstart kedacore-http-add-on to version 0.15.0-r1.
- Update cleanstart kedacore-http-add-on to version 0.13.0-r0.
- Update cleanstart rclone to version 1.71.2-r5.
- Update cleanstart knative-serving to version 1.22.1-r8.
- Update cleanstart knative-serving to version 1.23.0-r3.
- Update cleanstart haproxy-ingress to version 0.15.4-r9.
- Update cleanstart prometheus-mysqld-exporter to version 0.17.2-r10.
- Update cleanstart prometheus-mysqld-exporter to version 0.17.2-r8.
- Update cleanstart prometheus-mysqld-exporter to version 0.17.2-r9.
- Update cleanstart prometheus to version 3.5.3-r10.
- Update cleanstart prometheus to version 3.5.3-r9.
- Update cleanstart keda to version 2.20.2-r4.
- Update cleanstart yunikorn-k8shim to version 1.8.0-r1.
- Update cleanstart keda to version 2.17.2-r3.
- Update cleanstart prometheus-operator to version 0.90.1-r6.
- Update cleanstart renovate to version 44.158.0-r2.
- Update cleanstart prometheus-mysqld-exporter to version 0.18.0-r7.
- Update cleanstart prometheus-mysqld-exporter to version 0.18.0-r8.
- Update cleanstart prometheus-node-exporter-fips to version 1.10.2-r4.
- Update cleanstart prometheus-statsd-exporter to version 0.29.0-r3.
- Update cleanstart prometheus-statsd-exporter to version 0.29.0-r4.
- Update cleanstart prometheus-alertmanager to version 0.32.2-r1.
- Update cleanstart prometheus-operator to version 0.91.0-r10.
- Update cleanstart prometheus-operator to version 0.91.0-r9.
- Update cleanstart prometheus-statsd-exporter to version 0.31.0-r1.
- Update cleanstart prometheus-statsd-exporter to version 0.30.0-r2.
- Update cleanstart prometheus-mysqld-exporter to version 0.20.0-r2.
- Update cleanstart istio-pilot-discovery to version 1.29.8-r0.
- Update cleanstart istio-pilot-discovery to version 1.30.1-r1.
- Update cleanstart prometheus to version 3.12.0-r6.
- Update cleanstart prometheus to version 3.12.0-r7.
- Update cleanstart argo-cd to version 3.2.12-r10.
- Update cleanstart cert-manager to version 1.19.6-r5.
- Update cleanstart dex to version 2.42.1-r7.
- Update cleanstart restic-fips to version 0.18.1-r8.
- Update cleanstart nfs-subdir-external-provisioner to version 4.0.18-r2.
- Update cleanstart nfs-subdir-external-provisioner to version 4.0.18-r1.
- Update cleanstart prometheus-node-exporter to version 1.10.2-r6.
- Update cleanstart wave to version 0.12.0-r1.
- Update cleanstart weaviate-fips to version 1.38.20-r2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | stakater-reloader |
< 1.1.0-r6 < 1.1.0-r7 Fix: upgrade to 1.1.0-r6
|
| CleanStart | cleanstart | kube-state-metrics |
< 2.20.0-r4 Fix: upgrade to 2.20.0-r4
|
| CleanStart | cleanstart | gomplate |
< 4.3.3-r5 Fix: upgrade to 4.3.3-r5
|
| CleanStart | cleanstart | loki |
< 3.5.12-r6 Fix: upgrade to 3.5.12-r6
|
| CleanStart | cleanstart | opa-fips |
< 1.21.2-r0 Fix: upgrade to 1.21.2-r0
|
| CleanStart | cleanstart | istio-pilot-discovery |
< 1.30.5-r0 < 1.29.8-r0 < 1.30.1-r1 Fix: upgrade to 1.30.5-r0
|
| CleanStart | cleanstart | kedacore-http-add-on |
< 0.15.0-r1 < 0.13.0-r0 Fix: upgrade to 0.15.0-r1
|
| CleanStart | cleanstart | rclone |
< 1.71.2-r5 Fix: upgrade to 1.71.2-r5
|
| CleanStart | cleanstart | knative-serving |
< 1.22.1-r8 < 1.23.0-r3 Fix: upgrade to 1.22.1-r8
|
| CleanStart | cleanstart | haproxy-ingress |
< 0.15.4-r9 Fix: upgrade to 0.15.4-r9
|
| CleanStart | cleanstart | prometheus-mysqld-exporter |
< 0.17.2-r10 < 0.17.2-r8 < 0.17.2-r9 < 0.18.0-r7 < 0.18.0-r8 < 0.20.0-r2 Fix: upgrade to 0.17.2-r10
|
| CleanStart | cleanstart | prometheus |
< 3.5.3-r10 < 3.5.3-r9 < 3.12.0-r6 < 3.12.0-r7 Fix: upgrade to 3.5.3-r10
|
| CleanStart | cleanstart | keda |
< 2.20.2-r4 < 2.17.2-r3 Fix: upgrade to 2.20.2-r4
|
| CleanStart | cleanstart | yunikorn-k8shim |
< 1.8.0-r1 Fix: upgrade to 1.8.0-r1
|
| CleanStart | cleanstart | prometheus-operator |
< 0.90.1-r6 < 0.91.0-r10 < 0.91.0-r9 Fix: upgrade to 0.90.1-r6
|
| CleanStart | cleanstart | renovate |
< 44.158.0-r2 Fix: upgrade to 44.158.0-r2
|
| CleanStart | cleanstart | prometheus-node-exporter-fips |
< 1.10.2-r4 Fix: upgrade to 1.10.2-r4
|
| CleanStart | cleanstart | prometheus-statsd-exporter |
< 0.29.0-r3 < 0.29.0-r4 < 0.31.0-r1 < 0.30.0-r2 Fix: upgrade to 0.29.0-r3
|
| CleanStart | cleanstart | prometheus-alertmanager |
< 0.32.2-r1 Fix: upgrade to 0.32.2-r1
|
| CleanStart | cleanstart | argo-cd |
< 3.2.12-r10 Fix: upgrade to 3.2.12-r10
|
| CleanStart | cleanstart | cert-manager |
< 1.19.6-r5 Fix: upgrade to 1.19.6-r5
|
| CleanStart | cleanstart | dex |
< 2.42.1-r7 Fix: upgrade to 2.42.1-r7
|
| CleanStart | cleanstart | restic-fips |
< 0.18.1-r8 Fix: upgrade to 0.18.1-r8
|
| CleanStart | cleanstart | nfs-subdir-external-provisioner |
< 4.0.18-r2 < 4.0.18-r1 Fix: upgrade to 4.0.18-r2
|
| CleanStart | cleanstart | prometheus-node-exporter |
< 1.10.2-r6 Fix: upgrade to 1.10.2-r6
|
| CleanStart | cleanstart | wave |
< 0.12.0-r1 Fix: upgrade to 0.12.0-r1
|
| CleanStart | cleanstart | weaviate-fips |
< 1.38.20-r2 Fix: upgrade to 1.38.20-r2
|
Original advisory text
When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU
CVE-2026-78667 affects multiple packages. When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Oct 2026
Updated31 Oct 2026
First seen31 Oct 2026
Sources
CLEANSTART-2026-OT78427 · OSV
Track software like this
Free during beta