Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

cleanstart dex can be deadlocked by crafted messages

published 1 month ago
Summary

The dex component of cleanstart can be forced into a complete halt if a connected peer sends specially crafted data after a channel is set up. This stops all communication over that connection, potentially disrupting services that rely on it. Apply the latest cleanstart updates or patches that correct this behavior to keep connections running smoothly.

What to do
  • Update cleanstart dex to version 2.45.1-r7.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart dex < 2.45.1-r7
Fix: upgrade to 2.45.1-r7
Original advisory text
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection
Multiple security vulnerabilities affect the dex package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-KK55331 · OSV
Track software like this
Free during beta