CLEANSTART-2026-YV15426: Xerial snappy-java before 1

Q: What level of attacker access is indicated by the available severity data?

The vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. The stated impact is on availability; confidentiality and integrity impacts are listed as none.

Q: Which deployments should be included in triage?

The affected software list includes cleanstart/rundeck, cleanstart/strimzi-kafka-operator, and cleanstart/solr. No product-specific differences in exposure or impact are provided, so all listed deployments should be reviewed.

Published Nov 13, 2026

Updated

CVE-2026-108106 affects multiple packages. Xerial snappy-java before 1. See references for individual vulnerability details.

Affected Software

3 affected componentsFixes available

cleanstart/rundeck<6.0.1-r11

6.0.1-r11

cleanstart/strimzi-kafka-operator<0.51.0-r8

0.51.0-r8

cleanstart/solr<9.11.0-r0

9.11.0-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.0.1-r11
Upgrade
Upgrade cleanstart/strimzi-kafka-operator to a version that resolves this vulnerability.
Fixed in 0.51.0-r8
Upgrade
Upgrade cleanstart/solr to a version that resolves this vulnerability.
Fixed in 9.11.0-r0

Event History

Nov 13, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-108106

Frequently Asked Questions

What level of attacker access is indicated by the available severity data?