CVE-2026-122129

The CESNET ipfixcol2 software (versions 2.7.1 before 2.9.0) is vulnerable to a memory allocation flaw in the Lz4Decoder::read_start_header() function. An unauthenticated attacker can exploit this by opening TCP connections and sending LZ4 start headers with very large buffer sizes. This allows th...

CVE-2026-122127

The CESNET ipfixcol2 software, versions 2.7.1 before 2.9.0 , is vulnerable to a heap-based buffer overflow within the Lz4Decoder.cpp component. The root cause allows unauthenticated network peers to provide a small ring buffer_size followed by a large decompressed_size, enabling them to write up ...

Arbitrary Code Execution

github.com/cloudflare/golz4 is vulnerable to arbitrary code execution. The vulnerability is due to the use of an unsafe version of the LZ4 decoder LZ4uncompress which is used in the Uncompress function resulting in memory corruption via specially crafted user input...