CLEANSTART-2026-EU04352: GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names

Q: Which CleanStart packages are identified as affected?

The affected packages listed are cleanstart/rundeck, cleanstart/keycloak, cleanstart/spark-sc213-jdk17-py312, and cleanstart/solr.

Q: What does the supplied severity vector indicate about exploitation requirements and impact?

The vector indicates network-accessible exploitation with low attack complexity, no required privileges, and required user interaction. It indicates low confidentiality impact and no integrity or availability impact.

Published Nov 13, 2026

Updated

CVE-2026-124077 affects multiple packages. The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. See references for individual vulnerability details.

Affected Software

4 affected componentsFixes available

cleanstart/rundeck<6.1.0-r6

6.1.0-r6

cleanstart/keycloak<26.8.2-r0

26.8.2-r0

cleanstart/spark-sc213-jdk17-py312<4.2.1-r0

4.2.1-r0

cleanstart/solr<9.11.0-r3

9.11.0-r3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r6
Upgrade
Upgrade cleanstart/keycloak to a version that resolves this vulnerability.
Fixed in 26.8.2-r0
Upgrade
Upgrade cleanstart/spark-sc213-jdk17-py312 to a version that resolves this vulnerability.
Fixed in 4.2.1-r0
Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 9.11.0-r3

Event History

Nov 13, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-124077

Frequently Asked Questions

Which CleanStart packages are identified as affected?