Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.lz4:lz4-java

8 known vulnerabilities (3 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 3 high, 4 medium, 1 low
Dependents
193
Registry
Maven Central

Advisories 8

  • CVE-2026-106453Medium 5.3

    yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

    Affected: through 1.8.1.

  • CVE-2026-106452Medium 5.3

    yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

    Affected: through 1.8.1.

  • yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

    Affected: from 1.7.0, through 1.8.1.

  • CVE-2026-106450Medium 5.3

    yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

    Affected: through 1.8.1.

  • yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

    Affected: through 1.8.1.

  • CVE-2026-59949Medium 6.5

    yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash JNI (StreamingXXHash32JNI / StreamingXXHash64JNI)

    Affected: through 1.8.1.

  • yawkat LZ4 Java has a possible information leak in Java safe decompressor

    Affected: through 1.8.1.

  • org.lz4:lz4-java - Out-of-Bounds Memory Access

    Affected: from 1.0.0, through 1.8.0; fixed in 1.8.1.