CLEANSTART-2026-BM88489: Ning compress-lzf before 1
Published Nov 13, 2026
·Updated
Security vulnerability affects the spark-sc213-jdk17-py312 package. Ning compress-lzf before 1.
Affected Software
1 affected componentFixes available
cleanstart/spark-sc213-jdk17-py312<4.1.4-r0
4.1.4-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/spark-sc213-jdk17-py312to a version that resolves this vulnerability.Fixed in 4.1.4-r0
Event History
Nov 13, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does exploitation require authentication, user interaction, or local access?
No. The vulnerability is rated as network-accessible with low attack complexity, requires no privileges, and requires no user interaction.
2
What is the expected security impact if exploitation succeeds?
The provided severity vector indicates high confidentiality and availability impact, with no integrity impact indicated.
3
Which deployments should be assessed first?
Assess deployments using the cleanstart/spark-sc213-jdk17-py312 package, particularly where the included Ning compress-lzf component is before version 1.