Description
yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| yawkat | lz4-java | < 1.10.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lz4-java | 1.11.2+ds1-1 | — |
| Debian 13 | lz4-java | No fix yet | — |
| Debian 12 | lz4-java | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | lz4-java | No fix yet | — |
| Ubuntu 26.04 LTS | lz4-java | No fix yet | — |
| Ubuntu 25.10 | lz4-java | No fix yet | — |
| Ubuntu 24.04 LTS | lz4-java | No fix yet | — |
| Ubuntu 22.04 LTS | lz4-java | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | lz4-java | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | jmc | 8.2.0-18.el9_7.2 | RHSA-2026:20568, RHSA-2026:0752 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.6 EUS | jmc | 8.2.0-18.el9_6.2 | RHSA-2026:0751 |
| RHEL 9.4 EUS | jmc | 8.2.0-17.el9_4.2 | RHSA-2026:1823 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.4-2.GA_redhat_00005.1.el8eap | RHSA-2026:1871, RHSA-2026:1870 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | jmc | 8.2.0-18.el9_7.2 | ALSA-2026:20568, ALSA-2026:0752 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | jmc | 8.2.0-18.el9_7.2 | RLSA-2026:20568, RLSA-2026:0752 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | jmc | 8.2.0-18.el9_7.2 | ELSA-2026-20568, ELSA-2026-0752 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cassandra-4.1 | 4.1.11-r0 | — |
| Wolfi rolling | debezium-3.5-connector-jdbc +5 | 3.5.1-r0 | — |
| Wolfi rolling | debezium-connector-db2-3.5 +2 | 3.5.0-r1 | — |
| Wolfi rolling | debezium-connector-vitess-3.5 +1 | 3.5.1-r1 | — |
| Wolfi rolling | kafka-4.1 | 4.1.1-r7 | — |
| Wolfi rolling | sonarqube | 26.2.0.119303-r2 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.2-r8 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.1-r9 | — |
| Wolfi rolling | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 0.51.0-r2 | — |
| Wolfi rolling | zipkin +1 | 3.5.1-r14 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | at.yawk.lz4:lz4-java | < 1.10.1 | 1.10.1 | GHSA-cmp6-m4wj-q63q |
| Maven | net.jpountz.lz4:lz4 | <= 1.8.1 | — | GHSA-cmp6-m4wj-q63q |
| Maven | org.lz4:lz4-java | <= 1.8.1 | — | GHSA-cmp6-m4wj-q63q |
| Maven | org.lz4:lz4-pure-java | <= 1.8.1 | — | GHSA-cmp6-m4wj-q63q |
Advisories 21
- ALSA-2026:20568 Important: jmc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:0752 Important: jmc security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:20568 Red Hat Security Advisory: jmc security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1823 Red Hat Security Advisory: JMC bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:0752 Red Hat Security Advisory: jmc security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:0751 Red Hat Security Advisory: jmc security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:1870 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.4 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
- RHSA-2026:1871 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.4 security update Red Hat Security Advisories (RHSA) · Oct 7, 2026
- WID-SEC-2026-0019 Red Hat Enterprise Linux (Quarkus): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 23, 2026
- WID-SEC-2026-2431 Oracle SQL Developer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- ELSA-2026-20568 Important: jmc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 23, 2026
- WID-SEC-2026-1752 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 31, 2026
- RLSA-2026:20568 Important: jmc security update Rocky Linux Security Advisories · May 30, 2026
- WID-SEC-2026-1204 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1202 Oracle Hyperion: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-0800 LogStash: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Mar 19, 2026
- RLSA-2026:0752 Important: jmc security update Rocky Linux Security Advisories · Jan 21, 2026
- NCSC-2026-0021 Kwetsbaarheden verholpen in Oracle Database Server producten NCSC-NL (Netherlands) · Jan 21, 2026
- ELSA-2026-0752 Important: jmc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jan 19, 2026
- WID-SEC-2026-0099 Elasticsearch: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Jan 13, 2026