CLEANSTART-2026-JP69288: asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow c...

Q: What does an attacker need to send to trigger the issue?

An attacker needs to provide untrusted raw-binary input to the asynchronous Smile parser, NonBlockingByteArrayParser, with a chosen length prefix. The parser uses that prefix to allocate a byte array before reading the body.

Q: What is the likely impact of a malicious length prefix?

Because the length has no upper bound or overflow check, a crafted prefix can cause an attempt to allocate an excessively large byte array. This can lead to resource exhaustion or allocation failures in processes that parse attacker-controlled Smile data.

Q: How can I determine whether my deployment is exposed?

Review whether the affected solr package uses NonBlockingByteArrayParser to process Smile-formatted raw-binary data from untrusted sources. The provided data does not identify affected versions, fixed versions, or configuration-specific exposure.

Published Nov 8, 2026

Updated

Security vulnerability affects the solr package. The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check.

Affected Software

1 affected componentFixes available

cleanstart/solr<10.1.0-r0

10.1.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 10.1.0-r0

Event History

Nov 8, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-104895

Frequently Asked Questions

What does an attacker need to send to trigger the issue?

An attacker needs to provide untrusted raw-binary input to the asynchronous Smile parser, NonBlockingByteArrayParser, with a chosen length prefix. The parser uses that prefix to allocate a byte array before reading the body.

What is the likely impact of a malicious length prefix?

Because the length has no upper bound or overflow check, a crafted prefix can cause an attempt to allocate an excessively large byte array. This can lead to resource exhaustion or allocation failures in processes that parse attacker-controlled Smile data.

How can I determine whether my deployment is exposed?

Review whether the affected solr package uses NonBlockingByteArrayParser to process Smile-formatted raw-binary data from untrusted sources. The provided data does not identify affected versions, fixed versions, or configuration-specific exposure.

CLEANSTART-2026-JP69288: asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow c...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to send to trigger the issue?

What is the likely impact of a malicious length prefix?

How can I determine whether my deployment is exposed?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to send to trigger the issue?

What is the likely impact of a malicious length prefix?

How can I determine whether my deployment is exposed?