CLEANSTART-2026-SV96554: Xerial snappy-java from 1

Q: Which listed CleanStart software packages are affected?

The affected software listed is cleanstart/kafka, cleanstart/solr, cleanstart/apache-nifi, and cleanstart/rundeck.

Q: What access and conditions does the severity vector indicate for exploitation?

The vector indicates network-based exploitation with no required privileges or user interaction. It also indicates high attack complexity.

Q: What impact does the severity vector indicate?

The vector indicates low confidentiality and integrity impact, with no availability impact indicated.

Published Nov 11, 2026

Updated

CVE-2026-108104 affects multiple packages. Xerial snappy-java from 1. See references for individual vulnerability details.

Affected Software

5 affected componentsFixes available

cleanstart/kafka<4.0.2-r6

4.0.2-r6

cleanstart/kafka<4.4.0-r1

4.4.0-r1

cleanstart/solr<10.0.0-r12

10.0.0-r12

cleanstart/apache-nifi<2.11.0-r3

2.11.0-r3

cleanstart/rundeck<6.1.0-r5

6.1.0-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.0.2-r6
Upgrade
Upgrade cleanstart/kafka to a version that resolves this vulnerability.
Fixed in 4.4.0-r1
Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 10.0.0-r12
Upgrade
Upgrade cleanstart/apache-nifi to a version that resolves this vulnerability.
Fixed in 2.11.0-r3
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r5

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-108104

Frequently Asked Questions

Which listed CleanStart software packages are affected?

The affected software listed is cleanstart/kafka, cleanstart/solr, cleanstart/apache-nifi, and cleanstart/rundeck.

What access and conditions does the severity vector indicate for exploitation?

The vector indicates network-based exploitation with no required privileges or user interaction. It also indicates high attack complexity.

What impact does the severity vector indicate?

The vector indicates low confidentiality and integrity impact, with no availability impact indicated.

CLEANSTART-2026-SV96554: Xerial snappy-java from 1

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which listed CleanStart software packages are affected?

What access and conditions does the severity vector indicate for exploitation?

What impact does the severity vector indicate?

Company

Resources

Contact

Frequently Asked Questions

Which listed CleanStart software packages are affected?

What access and conditions does the severity vector indicate for exploitation?

What impact does the severity vector indicate?