CLEANSTART-2026-UF96774 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the kafka package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-QB31666 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106450 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-MS32897 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106449 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-TX68944 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106451 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-HV49575 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106452 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

CLEANSTART-2026-PM70548 yawkat LZ4 Java provides LZ4 compression for Java

CVE-2026-106453 affects multiple packages. yawkat LZ4 Java provides LZ4 compression for Java. See references for individual vulnerability details...

Security Bulletin: Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26

Summary Multiple vulnerabilities were addressed in IBM DataStax Enterprise 6.9.26 Vulnerability Details CVEID:CVE-2026-9828 DESCRIPTION: Deserialization of untrusted data vulnerability in QOS.CH Sarl logback logback-core HardenedObjectInputStream logback-core modules allows Object Injection albei...

CLEANSTART-2026-CX61220 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-PK52336 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-EA15585 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-IA44862 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-LM18724 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-nifi package. yawkat LZ4 Java provides LZ4 compression for Java...

CLEANSTART-2026-UB44506 yawkat LZ4 Java provides LZ4 compression for Java

Security vulnerability affects the apache-hive package. yawkat LZ4 Java provides LZ4 compression for Java...

EUVD-2026-93868

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user...

EUVD-2026-93862

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError...

EUVD-2026-93865

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs...

EUVD-2026-93871

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header...

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

Summary LZ4BlockInputStream grows its compressed-input buffer to the attacker-controlled compressedLen value from the legacy LZ4Block stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap. Details In...

yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

Summary LZ4DecompressorWithLength.decompressbyte, int allocates whatever size the 4-byte length header declares, before it reads a single byte of compressed data. A 5-byte input whose header says 0x40000000 makes the JVM commit a gigabyte and can cause heap exhaustion. Details...

GHSA-6CX8-RJF8-PR8G yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

Summary LZ4DecompressorWithLength.decompressbyte, int allocates whatever size the 4-byte length header declares, before it reads a single byte of compressed data. A 5-byte input whose header says 0x40000000 makes the JVM commit a gigabyte and can cause heap exhaustion. Details...