Insecure Temporary File Handling

lz4-java is vulnerable to Insecure Temporary File Handling. The vulnerability is due to the way net.jpountz.util.Native.load extracts the native library: it creates a lock file with File.createTempFile and then derives the library path by stripping the .lck suffix, opening the resulting file with...

EUVD-2026-93868

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user...

Linux Distros Unpatched Vulnerability : CVE-2026-106451

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive tempora...

CVE-2026-106451

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

DEBIAN-CVE-2026-106451

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

CVE-2026-106451 yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

CVE-2026-106451

The yawkat LZ4 Java library (versions 1.7.0 through 1.11.4 ) is vulnerable to a TOCTOU race condition during native library extraction. The net.jpountz.util.Native.load() function creates a temporary .lck file but uses a predictable path for the actual native library. Because FileOutputStream ope...

CVE-2026-106451 yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

CVE-2026-106451

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

CVE-2026-106451: Time-of-check Time-of-use (TOCTOU) Race Condition

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

PT-2026-107240

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions 1.7.0 through 1.11.3 Description The net.jpountz.util.Native.load function creates an exclusive temporary .lck file using File.createTempFile but derives the native-library path by removing the suffix. Subsequently,...

EUVD-2021-0893

Malware in sbrugna...

EUVD-2023-1735

Malicious code in bioql PyPI...

EUVD-2023-0537

Malicious code in bioql PyPI...

CVE-2023-33695

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile function at /core/io/FileUtil.java...

CVE-2023-43123

On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method...

CVE-2023-43123: Exposure of Sensitive Information to an Unauthorized Actor

On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method...

CVE-2023-33695

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile function at /core/io/FileUtil.java...

CVE-2023-33695: Incorrect Permission Assignment for Critical Resource

Hutool v5.8.17 and below was discovered to contain an information disclosure vulnerability via the File.createTempFile function at /core/io/FileUtil.java...

CVE-2023-33695

CVE-2023-33695 affects Hutool Core v5.8.17 and earlier, where FileUtil.createTempFile() stores the temporary file with insecure default permissions, enabling information disclosure. Multiple sources (NVD, Red Hat, GHSA, OSV, Veracode, CNNVD) confirm the vulnerability in /core/io/FileUtil.java. No...