CLEANSTART-2026-DJ12675: Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
Security vulnerability affects the sonarqube package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.10.0.133078-r1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The reported vector is network-based and requires no privileges or user interaction. The attack complexity is rated low.
What is the expected security impact?
The reported impact is high availability impact, with no reported confidentiality or integrity impact. The reported scope is unchanged.
Which deployments should be prioritized for triage?
Prioritize deployments using the affected cleanstart/sonarqube software where the relevant functionality is reachable over a network. The provided data does not identify affected versions or configuration-specific exposure conditions.