EUVD-2026-60947

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949

In lz4-java prior to 1.11.1, JNI-backed XXHash methods (hash32, hash64, streaming hash update) pass unvalidated byte arrays and off/len ranges to native code, enabling null-array or out-of-bounds reads that crash the JVM. Upgrade to 1.11.1. No in-the-wild exploitation reported. https://github.com...

CVE-2026-59949: NULL Pointer Dereference

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

The vulnerability of the lz4-java data compression library, related to the disclosure of information during data transmission, allows attackers to disclose protected information.

The vulnerability of the lz4-java data compression library is related to the disclosure of information during data transmission. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected information...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15529 more potentially affected by CVE-2026-59949 via org.lz4:lz4-java (>=1.4, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-59949 Source advisory: SNYK:JAVA-ORGLZ4-18313067...

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

Summary Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the...

NULL Pointer Dereference

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to NULL Pointer Dereference and out-of-bounds read in the native XXHash implementations reached through XXHashFactory.nativeInstance, where...

GHSA-XX22-P4CH-683R LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

Summary Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the...

PT-2026-64441

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.1 Description JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments, allowing null arrays or oversized ranges to reach native code. This can lead to readin...

MiracleLinux 9 : jmc-8.2.0-19.el9_8.2 (AXSA:2026-1271:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1271:02 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggli...

AlmaLinux 9 : jmc (ALSA-2026:20568)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:20568 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggling vi...

Security Bulletin: IBM Data Server Driver for JDBC and SQLJ is affected by a vulnerability in org.lz4 1.8.0 (CVE-2025-12183)

Summary IBM Data Server Driver for JDBC and SQLJ is affected by a vulnerability in org.lz4 1.8.0 CVE-2025-12183 Vulnerability Details CVEID:CVE-2025-12183 DESCRIPTION: Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read...

ROOT-APP-MAVEN-CVE-2025-12183 CVE-2025-12183 in io.root.org.lz4:lz4-java - Patched by Root

Root has patched CVE-2025-12183 in the io.root.org.lz4:lz4-java package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2025-66566 CVE-2025-66566 in io.root.org.lz4:lz4-java - Patched by Root

Root has patched CVE-2025-66566 in the io.root.org.lz4:lz4-java package for Root:Maven. Multiple fixed versions available...

jmc security update

An update is available for jmc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced s...

RockyLinux 9 : jmc (RLSA-2026:20568)

The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:20568 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggling v...

RHEL 9 : jmc (RHSA-2026:20568)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:20568 advisory. JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced set of tools that enables efficient and detailed analysis o...

lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing

A flaw was found in lz4-java. This vulnerability allows disclosure of sensitive data via crafted compressed input due to insufficient clearing of the output buffer in Java-based decompressor implementations...

Important: Red Hat Security Advisory: jmc security update

An update for jmc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...