PT-2026-107242

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.2 Description The LZ4DecompressorWithLength component trusts the four-byte decompressed-length header via the getDecompressedLength function before validating the compressed input. This allows an attacker...

PT-2026-107241

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.2 Description The refill function in net.jpountz.lz4.LZ4BlockInputStream fails to properly validate the compressedLen field in a legacy LZ4Block header. While it checks that the value is non-negative, it...

CVE-2026-106452: Memory Allocation with Excessive Size Value

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data,...

CVE-2026-106453: Memory Allocation with Excessive Size Value

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size...

CLEANSTART-2026-IG77090 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-59949 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-YG17751 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-hive package. yawkat LZ4 Java provides LZ4 compression for Java...

PT-2026-108583

Security vulnerability affects the apache-hive package. yawkat LZ4 Java provides LZ4 compression for Java...

Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite

Summary There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite Vulnerability Details CVEID:CVE-2026-59949 DESCRIPTION: yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object a...

CLEANSTART-2026-AM39668 yawkat LZ4 Java provides LZ4 compression for Java

Multiple security vulnerabilities affect the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-FR63847 yawkat LZ4 Java provides LZ4 compression for Java

Multiple security vulnerabilities affect the elasticsearch package. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

Linux Distros Unpatched Vulnerability : CVE-2026-59949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len...

DEBIAN-CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

UBUNTU-CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

EUVD-2026-60947

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949 yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash JNI (StreamingXXHash32JNI / StreamingXXHash64JNI)

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...