Skip to content
OpenAdvisories
High WID-SEC-2026-4013 3 CVEs

DBeaver: Mehrere Schwachstellen

Published Oct 18, 2026 · Updated Nov 8, 2026 · Revision 3 · de

Vendor: IBM Product: Operational Decision Manager Product: SPSS Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in DBeaver ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial-of-Service-Zustand auszulösen.

Product

DBeaver ist ein SQL-Client und ein Werkzeug zur Datenbankverwaltung.

Vulnerabilities 3

  • High 7.3
    CVE-2026-106451 Public exploit

    yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

    yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream op…

    yawkat lz4-java druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2026-106450

    yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

    yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attac…

    yawkat lz4-java druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Low 3.7
    CVE-2026-106449

    yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

    yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty bl…

    yawkat lz4-java druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Revision history

  1. #3

    Neue Updates von IBM aufgenommen

  2. #2

    Neue Updates von IBM aufgenommen

  3. #1

    Initiale Fassung

References