Red Hat Enterprise Linux 8/jmc:rhel8/lz4-java

Red Hat · Package

6 reports

Vulnerability alerts

Report	Product	Ecosystem	Severity	Fix status	Last updated
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local userCVE-2026-106451 · GHSA-MCR4-QMVW-PX4G	at.yawk.lz4:lz4-java org.lz4:lz4-java	MavenRed Hat	High	Fix reported	2026-10-08
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsCVE-2026-106450 · GHSA-GM45-99XC-R7WV	at.yawk.lz4:lz4-java org.lz4:lz4-java	MavenRed Hat	Medium	Fix reported	2026-10-08
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryErrorCVE-2026-106453 · GHSA-6CX8-RJF8-PR8G	at.yawk.lz4:lz4-java org.lz4:lz4-java	MavenRed Hat	Medium	Fix reported	2026-10-07
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headerCVE-2026-106452 · GHSA-4V53-57PG-C464	at.yawk.lz4:lz4-java org.lz4:lz4-java	MavenRed Hat	Medium	Fix reported	2026-10-07
LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array rangesCVE-2026-59949 · GHSA-XX22-P4CH-683R	at.yawk.lz4:lz4-java org.lz4:lz4-java	MavenRed Hat	Medium	Fix reported	2026-09-10
yawkat LZ4 Java has a possible information leak in Java safe decompressorCVE-2025-66566 · GHSA-CMP6-M4WJ-Q63Q	at.yawk.lz4:lz4-java net.jpountz.lz4:lz4	MavenRed Hat	High	Fix reported	2026-09-10