Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
Elasticsearch, Strimzi Kafka Operator, Kafka risk malicious LZ4 data
published 4 days ago
Summary
The Java LZ4 compression library used by Elasticsearch, Strimzi Kafka Operator and Kafka can be fooled by specially crafted compressed files. This could let an attacker cause the application to crash or run unwanted code. Update to the latest library version or turn off LZ4 compression until a fix is applied.
What to do
- Update cleanstart elasticsearch to version 9.2.8-r7.
- Update cleanstart elasticsearch to version 9.4.8-r0.
- Update cleanstart strimzi-kafka-operator to version 1.2.0-r5.
- Update cleanstart strimzi-kafka-operator to version 0.51.0-r7.
- Update cleanstart kafka to version 4.2.0-r6.
- Update cleanstart kafka to version 4.3.1-r8.
- Update cleanstart elasticsearch to version 9.3.8-r7.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | elasticsearch |
< 9.2.8-r7 < 9.4.8-r0 < 9.3.8-r7 Fix: upgrade to 9.2.8-r7
|
| CleanStart | cleanstart | strimzi-kafka-operator |
< 1.2.0-r5 < 0.51.0-r7 Fix: upgrade to 1.2.0-r5
|
| CleanStart | cleanstart | kafka |
< 4.2.0-r6 < 4.3.1-r8 Fix: upgrade to 4.2.0-r6
|
Original advisory text
yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-106449 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen15 Oct 2026
Sources
CLEANSTART-2026-YW37682 · OSV
Track software like this
Free during beta