CLEANSTART-2026-MZ82451: yawkat LZ4 Java provides LZ4 compression for Java

Q: Which deployments should be prioritized for review?

The affected software list identifies cleanstart/sonarqube and cleanstart/strimzi-kafka-operator. The advisory states that the underlying CVE affects multiple packages, but does not provide affected version ranges.

Q: What level of attacker access is indicated by the severity data?

The CVSS vector indicates network-based exploitation with low attack complexity and no required privileges or user interaction. The stated impact is limited to low availability impact, with no confidentiality or integrity impact listed.

Published Nov 12, 2026

Updated

CVE-2026-106450 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/sonarqube<26.10.0.133078-r0

26.10.0.133078-r0

cleanstart/strimzi-kafka-operator<1.3.0-r0

1.3.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.10.0.133078-r0
Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.10.0.133078-r1
Upgrade
Upgrade cleanstart/strimzi-kafka-operator to a version that resolves this vulnerability.
Fixed in 1.3.0-r0

Event History

Nov 12, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-106450

Frequently Asked Questions

Which deployments should be prioritized for review?