CLEANSTART-2026-DK63091: yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-106451 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.10.0.133078-r0 - Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.10.0.133078-r1 - Upgrade
Upgrade
cleanstart/strimzi-kafka-operatorto a version that resolves this vulnerability.Fixed in 1.3.0-r0
Event History
Frequently Asked Questions
Which deployments should be prioritized for investigation?
The affected software listed for this advisory is cleanstart/sonarqube and cleanstart/strimzi-kafka-operator. The underlying issue is associated with yawkat LZ4 Java, so prioritize deployments of those packages that include or use that Java compression component.
What level of attacker access is indicated by the severity vector?
The vector indicates local attack access, low privileges, high attack complexity, and an additional prerequisite condition. It does not indicate that exploitation can be performed remotely without prior access.
What is the potential impact if exploitation succeeds?
The severity vector indicates high impact to confidentiality, integrity, and availability for the vulnerable component. It indicates no impact to confidentiality, integrity, or availability of a separate downstream component.