CVE-2026-59949

NameCVE-2026-59949
Descriptionyawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1145019

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
lz4-java (PTS)bookworm1.8.0-3vulnerable
trixie1.8.0-4vulnerable
forky, sid1.11.2+ds1-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
lz4-javasource(unstable)1.11.2+ds1-11145019

Notes

[trixie] - lz4-java <no-dsa> (Minor issue)
[bookworm] - lz4-java <postponed> (Minor issue)
https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r
Fixed by: https://github.com/yawkat/lz4-java/commit/dbd86d04b8dd716e1c2bc626be54189997d910da (v1.11.1)

Search for package or bug name: Reporting problems