CLEANSTART-2026-UI99375: CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Q: What kind of deployment is exposed?

The affected software is the cleanstart/solr package. The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction.

Q: What is the likely security impact?

The supplied vector indicates availability impact only: high availability impact, with no confidentiality or integrity impact. This is consistent with a denial-of-service risk involving CBOR parsing.

Q: Can configured StreamReadConstraints be relied on to limit CBOR input?

No. The CBOR parser in the affected FasterXML jackson-dataformats-binary component never invokes StreamReadConstraints, so those constraints are not applied during CBOR parsing.

Published Nov 11, 2026

Updated

Security vulnerability affects the solr package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.

Affected Software

1 affected componentFixes available

cleanstart/solr<10.0.0-r12

10.0.0-r12

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 10.0.0-r12

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-68495

Frequently Asked Questions

What kind of deployment is exposed?

The affected software is the cleanstart/solr package. The vulnerability is remotely exploitable with low attack complexity and requires no privileges or user interaction.

What is the likely security impact?

The supplied vector indicates availability impact only: high availability impact, with no confidentiality or integrity impact. This is consistent with a denial-of-service risk involving CBOR parsing.

Can configured StreamReadConstraints be relied on to limit CBOR input?

No. The CBOR parser in the affected FasterXML jackson-dataformats-binary component never invokes StreamReadConstraints, so those constraints are not applied during CBOR parsing.

CLEANSTART-2026-UI99375: CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What kind of deployment is exposed?

What is the likely security impact?

Can configured StreamReadConstraints be relied on to limit CBOR input?

Company

Resources

Contact

Frequently Asked Questions

What kind of deployment is exposed?

What is the likely security impact?

Can configured StreamReadConstraints be relied on to limit CBOR input?