CLEANSTART-2026-CX91057

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CX91057.json
JSON Data
https://api.osv.dev/v1/vulns/CLEANSTART-2026-CX91057
Upstream
  • CVE-2026-97031
Published
2026-10-23T00:37:33Z
Modified
2026-10-23T00:45:04Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specify...
Details

CVE-2026-97031 affects multiple packages. Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. See references for individual vulnerability details.

References

Affected packages

CleanStart
dex

Package

Name
dex
Purl
pkg:apk/cleanstart/dex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.45.1-r9

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CX91057.json"
rabbitmq-cluster-operator

Package

Name
rabbitmq-cluster-operator
Purl
pkg:apk/cleanstart/rabbitmq-cluster-operator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.22.4-r2

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CX91057.json"
kyverno

Package

Name
kyverno
Purl
pkg:apk/cleanstart/kyverno

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.18.1-r5

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CX91057.json"
rabbitmq-cluster-operator

Package

Name
rabbitmq-cluster-operator
Purl
pkg:apk/cleanstart/rabbitmq-cluster-operator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.19.2-r8

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CX91057.json"
rabbitmq-cluster-operator

Package

Name
rabbitmq-cluster-operator
Purl
pkg:apk/cleanstart/rabbitmq-cluster-operator

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.20.1-r10

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CX91057.json"
argo-cd

Package

Name
argo-cd
Purl
pkg:apk/cleanstart/argo-cd

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.2.3-r4

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CX91057.json"
mailpit

Package

Name
mailpit
Purl
pkg:apk/cleanstart/mailpit

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.29.7-r3

Database specific

source 
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-CX91057.json"