Package · Maven

at.yawk.lz4:lz4-java

8 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

High 7.3

CVE-2026-106451 Public exploit

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream op…

yawkat lz4-java druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Oct 6, 2026
High 8.2

CVE-2025-66566

yawkat LZ4 Java has a possible information leak in Java safe decompressor

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In a…

yawkat lz4-java zipkin spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven

Dec 5, 2025
High 8.8

CVE-2025-12183

org.lz4:lz4-java - Out-of-Bounds Memory Access

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

zipkin spark-4.0-scala-2.13 spark-4.1-scala-2.13 strimzi-kafka-operator-kafka-thirdparty-libs-cc Debian Ubuntu Wolfi Maven

Nov 28, 2025