CLEANSTART-2026-UK58613: snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google

Q: Which deployments should be evaluated for exposure?

Deployments using cleanstart/rundeck or cleanstart/solr should be evaluated. The supplied data does not identify affected package versions or configuration conditions.

Q: What does exploitation require according to the available severity data?

The vulnerability is network-reachable and does not require privileges or user interaction, but it has high attack complexity. Its stated impact is limited to availability; no confidentiality or integrity impact is listed.

Published Nov 13, 2026

Updated

CVE-2026-116590 affects multiple packages. snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. See references for individual vulnerability details.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.0.1-r11

6.0.1-r11

cleanstart/solr<9.11.0-r0

9.11.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.0.1-r11
Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 9.11.0-r0

Event History

Nov 13, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-116590

Frequently Asked Questions

Which deployments should be evaluated for exposure?