EUVD-2026-60947

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949

In lz4-java prior to 1.11.1, JNI-backed XXHash methods (hash32, hash64, streaming hash update) pass unvalidated byte arrays and off/len ranges to native code, enabling null-array or out-of-bounds reads that crash the JVM. Upgrade to 1.11.1. No in-the-wild exploitation reported. https://github.com...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3554 more potentially affected by CVE-2026-59949 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-59949 Source advisory: MEND:CVE-2026-59949...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949: NULL Pointer Dereference

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

lz4-java Information Disclosure

The vulnerability of the lz4-java data compression library is related to the disclosure of information during data transmission. Exploiting this vulnerability can allow an attacker, operating remotely, to disclose the protected information...

NULL Pointer Dereference

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to NULL Pointer Dereference and out-of-bounds read in the native XXHash implementations reached through XXHashFactory.nativeInstance, where...

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

Summary Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the...

GHSA-XX22-P4CH-683R LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

Summary Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3554 more potentially affected by CVE-2026-59949 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-59949 Source advisory: GHSA-XX22-P4CH-683R...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3554 more potentially affected by CVE-2026-59949 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-59949 Source advisory: OSV:GHSA-XX22-P4CH-683R...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3554 more potentially affected by CVE-2026-59949 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-59949 Source advisory: SNYK:JAVA-ATYAWKLZ4-18313068...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15576 more potentially affected by CVE-2026-59949 via org.lz4:lz4-java (>=1.4, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-59949 Source advisory: OSV:GHSA-XX22-P4CH-683R...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15576 more potentially affected by CVE-2026-59949 via org.lz4:lz4-java (>=1.4, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-59949 Source advisory: GHSA-XX22-P4CH-683R...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15576 more potentially affected by CVE-2026-59949 via org.lz4:lz4-java (>=1.4, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2026-59949 Source advisory: SNYK:JAVA-ORGLZ4-18313067...

PT-2026-64441

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.1 Description JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments, allowing null arrays or oversized ranges to reach native code. This can lead to readin...

MiracleLinux 9 : jmc-8.2.0-19.el9_8.2 (AXSA:2026-1271:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1271:02 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggli...

AlmaLinux 9 : jmc (ALSA-2026:20568)

The remote AlmaLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:20568 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggling vi...