Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

cleanstart packages may exhaust memory on deep data

published 28 days ago
Summary

The cleanstart Trino, AWS Network Policy Agent, Fabric Peer, Gotenberg, and Kubernetes DNS Node Cache packages can run out of stack space when they try to read very deeply nested or recursive information. This could cause the application to stop working or crash. Update to the latest versions of these packages, which now limit recursion depth, or avoid feeding them excessively nested data.

What to do
  • Update cleanstart trino to version 481-r5.
  • Update cleanstart aws-network-policy-agent to version 1.2.7-r0.
  • Update cleanstart fabric-peer to version 2.5.16-r3.
  • Update cleanstart fabric-peer to version 3.1.5-r2.
  • Update cleanstart gotenberg to version 8.33.0-r0.
  • Update cleanstart kubernetes-dns-node-cache to version 1.23.1-r2.
  • Update cleanstart pdfcpu to version 0.11.1-r1.
  • Update cleanstart temporal-server-fips to version 1.32.0-r2.
  • Update cleanstart rancher-loglevel to version 0.1.6-r1.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart trino < 481-r5
Fix: upgrade to 481-r5
CleanStart cleanstart aws-network-policy-agent < 1.2.7-r0
Fix: upgrade to 1.2.7-r0
CleanStart cleanstart fabric-peer < 2.5.16-r3
< 3.1.5-r2
Fix: upgrade to 2.5.16-r3
CleanStart cleanstart gotenberg < 8.33.0-r0
Fix: upgrade to 8.33.0-r0
CleanStart cleanstart kubernetes-dns-node-cache < 1.23.1-r2
Fix: upgrade to 1.23.1-r2
CleanStart cleanstart pdfcpu < 0.11.1-r1
Fix: upgrade to 0.11.1-r1
CleanStart cleanstart temporal-server-fips < 1.32.0-r2
Fix: upgrade to 1.32.0-r2
CleanStart cleanstart rancher-loglevel < 0.1.6-r1
Fix: upgrade to 0.1.6-r1
Original advisory text
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures
CVE-2026-33818 affects multiple packages. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. See references for individual vulnerability details.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published8 Oct 2026
Updated8 Oct 2026
First seen8 Oct 2026
Sources
CLEANSTART-2026-GC49284 · OSV
Track software like this
Free during beta