Security
فارسی
All products

Red Hat JBoss Enterprise Application Platform 8/lz4-java

Red Hat · Package
6 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowErrorCVE-2026-106449 · GHSA-343H-94H5-C4WR at.yawk.lz4:lz4-javaorg.lz4:lz4-java MavenRed Hat Low Fix reported
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local userCVE-2026-106451 · GHSA-MCR4-QMVW-PX4G at.yawk.lz4:lz4-javaorg.lz4:lz4-java MavenRed Hat High Fix reported
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsCVE-2026-106450 · GHSA-GM45-99XC-R7WV at.yawk.lz4:lz4-javaorg.lz4:lz4-java MavenRed Hat Medium Fix reported
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryErrorCVE-2026-106453 · GHSA-6CX8-RJF8-PR8G at.yawk.lz4:lz4-javaorg.lz4:lz4-java MavenRed Hat Medium Fix reported
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headerCVE-2026-106452 · GHSA-4V53-57PG-C464 at.yawk.lz4:lz4-javaorg.lz4:lz4-java MavenRed Hat Medium Fix reported
LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array rangesCVE-2026-59949 · GHSA-XX22-P4CH-683R at.yawk.lz4:lz4-javaorg.lz4:lz4-java MavenRed Hat Medium Fix reported