CLEANSTART-2026-IS51634: compress provides various compression algorithms

Q: Which Cleanstart software packages are identified as affected?

The affected software listed is cleanstart/gitea, cleanstart/mailpit, and cleanstart/keda.

Q: Does the available information identify the vulnerable compress version or a fixed version?

No. The provided data states that CVE-2026-116591 affects multiple packages, but it does not specify affected version ranges or fixed versions.

Q: What impact is indicated by the supplied severity vector?

The vector indicates network-reachable exploitation with low attack complexity, no privileges, and no user interaction required. It indicates an availability impact, while confidentiality and integrity impacts are marked as none.

Published Nov 11, 2026

Updated

CVE-2026-116591 affects multiple packages. compress provides various compression algorithms. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/gitea<1.27.3-r3

1.27.3-r3

cleanstart/mailpit<1.29.7-r6

1.29.7-r6

cleanstart/keda<2.20.2-r6

2.20.2-r6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/gitea to a version that resolves this vulnerability.
Fixed in 1.27.3-r3
Upgrade
Upgrade cleanstart/mailpit to a version that resolves this vulnerability.
Fixed in 1.29.7-r6
Upgrade
Upgrade cleanstart/keda to a version that resolves this vulnerability.
Fixed in 2.20.2-r6

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116591

Frequently Asked Questions

Which Cleanstart software packages are identified as affected?

The affected software listed is cleanstart/gitea, cleanstart/mailpit, and cleanstart/keda.

Does the available information identify the vulnerable compress version or a fixed version?

No. The provided data states that CVE-2026-116591 affects multiple packages, but it does not specify affected version ranges or fixed versions.

What impact is indicated by the supplied severity vector?

The vector indicates network-reachable exploitation with low attack complexity, no privileges, and no user interaction required. It indicates an availability impact, while confidentiality and integrity impacts are marked as none.

CLEANSTART-2026-IS51634: compress provides various compression algorithms

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which Cleanstart software packages are identified as affected?

Does the available information identify the vulnerable compress version or a fixed version?

What impact is indicated by the supplied severity vector?

Company

Resources

Contact

Frequently Asked Questions

Which Cleanstart software packages are identified as affected?

Does the available information identify the vulnerable compress version or a fixed version?

What impact is indicated by the supplied severity vector?