CLEANSTART-2026-LJ57058 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the sonarqube package. yawkat LZ4 Java provides LZ4 compression for Java...

PT-2026-107242

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.2 Description The LZ4DecompressorWithLength component trusts the four-byte decompressed-length header via the getDecompressedLength function before validating the compressed input. This allows an attacker...

PT-2026-107185

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.4 Description A flaw exists in the net.jpountz.lz4.LZ4BlockInputStream class when the stopOnEmptyBlock variable is set to false. In this configuration, the system handles well-formed empty LZ4Blocks by...

PT-2026-107240

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions 1.7.0 through 1.11.3 Description The net.jpountz.util.Native.load function creates an exclusive temporary .lck file using File.createTempFile but derives the native-library path by removing the suffix. Subsequently,...

PT-2026-107239

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.4 Description The readHeader function in net.jpountz.lz4.LZ4FrameInputStream allocates two 4 MiB block buffers when a maximum-block-size frame header is processed. In the default concatenated-frame mode, ...

PT-2026-107241

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.2 Description The refill function in net.jpountz.lz4.LZ4BlockInputStream fails to properly validate the compressedLen field in a legacy LZ4Block header. While it checks that the value is non-negative, it...

CVE-2026-106449: Uncontrolled Recursion

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

CVE-2026-106450: Allocation of Resources Without Limits or Throttling

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

CVE-2026-106452: Memory Allocation with Excessive Size Value

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data,...

CVE-2026-106453: Memory Allocation with Excessive Size Value

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size...

CVE-2026-106451: Time-of-check Time-of-use (TOCTOU) Race Condition

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

Rocky Linux 9 [CIQ] Security Update: jmc (crlsa-2026_0752)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-20260752 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 Tenable has extracted the preceding description block directly fro...

Rocky Linux 9 [CIQ] Security Update: jmc Multiple Vulnerabilities (crlsa-2026_20568)

The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620568 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggling via...

CLEANSTART-2026-IG77090 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-59949 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-YG17751 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-hive package. yawkat LZ4 Java provides LZ4 compression for Java...

OESA-2026-4077 lz4-java security update

LZ4 compression for Java, based on Yann Collet's work. This library provides access to two compression methods that both generate a valid LZ4 stream: fast scan LZ4: ° low memory footprint 16 KB, ° very fast fast scan with skipping heuristics in case the input looks incompressible, ° reasonable...

OESA-2026-4078 lz4-java security update

LZ4 compression for Java, based on Yann Collet's work. This library provides access to two compression methods that both generate a valid LZ4 stream: fast scan LZ4: ° low memory footprint 16 KB, ° very fast fast scan with skipping heuristics in case the input looks incompressible, ° reasonable...

OESA-2026-4079 lz4-java security update

LZ4 compression for Java, based on Yann Collet's work. This library provides access to two compression methods that both generate a valid LZ4 stream: fast scan LZ4: ° low memory footprint 16 KB, ° very fast fast scan with skipping heuristics in case the input looks incompressible, ° reasonable...

Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite

Summary There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite Vulnerability Details CVEID:CVE-2026-59949 DESCRIPTION: yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object a...

CLEANSTART-2026-AM39668 yawkat LZ4 Java provides LZ4 compression for Java

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...