| Name | CVE-2026-59949 |
| Description | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1145019 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| lz4-java (PTS) | bookworm | 1.8.0-3 | vulnerable |
| trixie | 1.8.0-4 | vulnerable | |
| forky, sid | 1.11.2+ds1-3 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| lz4-java | source | (unstable) | 1.11.2+ds1-1 | 1145019 |
[trixie] - lz4-java <no-dsa> (Minor issue)
[bookworm] - lz4-java <postponed> (Minor issue)
https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r
Fixed by: https://github.com/yawkat/lz4-java/commit/dbd86d04b8dd716e1c2bc626be54189997d910da (v1.11.1)