CLEANSTART-2026-LZ12851: asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow c...

Q: Which deployments should be prioritized for review?

Review deployments of cleanstart/elasticsearch, cleanstart/sonarqube, and cleanstart/trino that may process Smile-formatted input through the asynchronous NonBlockingByteArrayParser. The data does not identify affected versions within those packages.

Q: What attacker-controlled condition is relevant to exploitation?

An attacker needs to supply raw-binary Smile data with a chosen length prefix to the asynchronous parser. That prefix is used to allocate a byte array before the body is read.

Q: Are configuration-based mitigations or fixed versions available from this advisory data?

No. The provided data does not specify a fixed version, whether default configurations are affected, or an interim configuration workaround.

Published Nov 7, 2026

Updated

CVE-2026-104895 affects multiple packages. The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. See references for individual vulnerability details.

Affected Software

7 affected componentsFixes available

cleanstart/trino<484-r1

484-r1

cleanstart/sonarqube<26.7.0.124771-r11

26.7.0.124771-r11

cleanstart/sonarqube<26.8.0.126808-r6

26.8.0.126808-r6

cleanstart/elasticsearch<9.2.8-r11

9.2.8-r11

cleanstart/elasticsearch<9.5.5-r2

9.5.5-r2

cleanstart/elasticsearch<9.5.5-r3

9.5.5-r3

cleanstart/elasticsearch<9.3.8-r16

9.3.8-r16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/trino to a version that resolves this vulnerability.
Fixed in 484-r1
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.7.0.124771-r11
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.8.0.126808-r6
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.2.8-r11
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r2
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.5.5-r3
Upgrade
Upgrade cleanstart/elasticsearch to a version that resolves this vulnerability.
Fixed in 9.3.8-r16

Event History

Nov 7, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-104895

Frequently Asked Questions

Which deployments should be prioritized for review?

Review deployments of cleanstart/elasticsearch, cleanstart/sonarqube, and cleanstart/trino that may process Smile-formatted input through the asynchronous NonBlockingByteArrayParser. The data does not identify affected versions within those packages.

What attacker-controlled condition is relevant to exploitation?

An attacker needs to supply raw-binary Smile data with a chosen length prefix to the asynchronous parser. That prefix is used to allocate a byte array before the body is read.

Are configuration-based mitigations or fixed versions available from this advisory data?

No. The provided data does not specify a fixed version, whether default configurations are affected, or an interim configuration workaround.

CLEANSTART-2026-LZ12851: asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow c...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments should be prioritized for review?

What attacker-controlled condition is relevant to exploitation?

Are configuration-based mitigations or fixed versions available from this advisory data?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for review?

What attacker-controlled condition is relevant to exploitation?

Are configuration-based mitigations or fixed versions available from this advisory data?