CLEANSTART-2026-KM26314: snappy-java through 1

Q: Which deployments should be prioritized for investigation?

Deployments of cleanstart/kafka, cleanstart/solr, cleanstart/apache-nifi, or cleanstart/rundeck should be investigated because the advisory identifies snappy-java through version 1 as affected.

Q: Does exploitation require credentials or user interaction?

No. The supplied vector indicates network access, low attack complexity, no privileges required, and no user interaction.

Q: What is the expected security impact?

The stated impact is high availability impact, with no confidentiality or integrity impact indicated.

Published Nov 11, 2026

Updated

CVE-2026-90559 affects multiple packages. snappy-java through 1. See references for individual vulnerability details.

Affected Software

4 affected componentsFixes available

cleanstart/kafka<4.4.0-r1

4.4.0-r1

cleanstart/solr<10.0.0-r12

10.0.0-r12

cleanstart/apache-nifi<2.11.0-r3

2.11.0-r3

cleanstart/rundeck<6.1.0-r5

6.1.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.4.0-r1
Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 10.0.0-r12
Upgrade
Upgrade cleanstart/apache-nifi to a version that resolves this vulnerability.
Fixed in 2.11.0-r3
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-90559

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Deployments of cleanstart/kafka, cleanstart/solr, cleanstart/apache-nifi, or cleanstart/rundeck should be investigated because the advisory identifies snappy-java through version 1 as affected.

Does exploitation require credentials or user interaction?

No. The supplied vector indicates network access, low attack complexity, no privileges required, and no user interaction.

What is the expected security impact?

The stated impact is high availability impact, with no confidentiality or integrity impact indicated.

CLEANSTART-2026-KM26314: snappy-java through 1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Does exploitation require credentials or user interaction?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for investigation?

Does exploitation require credentials or user interaction?

What is the expected security impact?