Skip to content
OpenAdvisories

Package · Debian

lz4-java

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.3
    CVE-2026-106451

    yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

    yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream op…

    yawkat lz4-java org.lz4:lz4-java lz4-java Debian Ubuntu Maven
  • High 8.2
    CVE-2025-66566

    yawkat LZ4 Java has a possible information leak in Java safe decompressor

    yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In a…

    yawkat lz4-java org.lz4:lz4-java lz4-java Debian Ubuntu Maven
  • High 8.8
    CVE-2025-12183

    org.lz4:lz4-java - Out-of-Bounds Memory Access

    Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

    org.lz4:lz4-java lz4-java lz4-java at.yawk.lz4:lz4-java Debian Ubuntu Maven