CLEANSTART-2026-VZ95001

See a problem?
Import Source
https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-VZ95001.json
JSON Data
https://api.osv.dev/v1/vulns/CLEANSTART-2026-VZ95001
Upstream
  • CVE-2026-94439
Published
2026-10-27T00:38:42Z
Modified
2026-10-27T00:45:10Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the conne...
Details

CVE-2026-94439 affects multiple packages. When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. See references for individual vulnerability details.

References

Affected packages

CleanStart
cert-manager

Package

Name
cert-manager
Purl
pkg:apk/cleanstart/cert-manager

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.18.6-r8

Database specific

source
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-VZ95001.json"
argo-cd

Package

Name
argo-cd
Purl
pkg:apk/cleanstart/argo-cd

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.3.16-r1

Database specific

source
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-VZ95001.json"
argo-cd

Package

Name
argo-cd
Purl
pkg:apk/cleanstart/argo-cd

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.4.11-r1

Database specific

source
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-VZ95001.json"
dex

Package

Name
dex
Purl
pkg:apk/cleanstart/dex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.43.1-r8

Database specific

source
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-VZ95001.json"
kubernetes-csi-external-snapshotter

Package

Name
kubernetes-csi-external-snapshotter
Purl
pkg:apk/cleanstart/kubernetes-csi-external-snapshotter

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.7.0-r0

Database specific

source
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-VZ95001.json"
opa-fips

Package

Name
opa-fips
Purl
pkg:apk/cleanstart/opa-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.21.2-r2

Database specific

source
"https://github.com/cleanstart-dev/cleanstart-security-advisories/blob/main/advisories/2026/CLEANSTART-2026-VZ95001.json"