Description
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| yawkat | lz4-java | < 1.11.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lz4-java | 1.11.2+ds1-1 | — |
| Debian 13 | lz4-java | No fix yet | — |
| Debian 12 | lz4-java | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | lz4-java | No fix yet | — |
| Ubuntu 26.04 LTS | lz4-java | No fix yet | — |
| Ubuntu 24.04 LTS | lz4-java | No fix yet | — |
| Ubuntu 22.04 LTS | lz4-java | No fix yet | — |
| Ubuntu 20.04 LTS | lz4-java | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | akhq | 0.27.1-r17 | — |
| Wolfi rolling | apache-nifi | 2.10.0-r10 | — |
| Wolfi rolling | apache-pulsar-4.2 | 4.2.3-r4 | — |
| Wolfi rolling | apicurio-registry | 3.3.0-r13 | — |
| Wolfi rolling | cassandra-4.1 | 4.1.11-r4 | — |
| Wolfi rolling | cassandra-5.0 | 5.0.8-r13 | — |
| Wolfi rolling | cassandra-reaper | 5.0.0-r3 | — |
| Wolfi rolling | confluent-kafka | 8.4.0.406-r0 | — |
| Wolfi rolling | debezium-3.5-connector-jdbc +5 | 3.5.2-r3 | — |
| Wolfi rolling | debezium-3.6-connector-jdbc +6 | 3.6.1-r1 | — |
| Wolfi rolling | debezium-connector-db2-3.5 +1 | 3.5.2-r2 | — |
| Wolfi rolling | debezium-connector-db2-3.6 +2 | 3.6.0-r1 | — |
| Wolfi rolling | debezium-connector-ibmi-3.5 +1 | 3.5.2-r5 | — |
| Wolfi rolling | debezium-connector-informix-3.5 | 3.5.2-r4 | — |
| Wolfi rolling | debezium-connector-vitess-3.6 | 3.6.0-r2 | — |
| Wolfi rolling | druid | 37.0.0-r48 | — |
| Wolfi rolling | flyway | 13.7.0-r1 | — |
| Wolfi rolling | kafka-4.1 | 4.1.2-r6 | — |
| Wolfi rolling | kafka-4.2 | 4.2.1-r6 | — |
| Wolfi rolling | logstash-9.3 +1 | 9.3.8-r3 | — |
| Wolfi rolling | logstash-9.4 +1 | 9.4.5-r3 | — |
| Wolfi rolling | opensearch-3-discovery-ec2 +2 | 3.8.0-r3 | — |
| Wolfi rolling | opensearch-3-security | 3.7.0-r13 | — |
| Wolfi rolling | sonarqube | 26.7.0.124771-r3 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.4-r1 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.3-r2 | — |
| Wolfi rolling | strimzi-kafka-operator-kafka-init +6 | 1.1.0-r4 | — |
| Wolfi rolling | thingsboard-tb-node +1 | 4.3.1.3-r13 | — |
| Wolfi rolling | trino-plugin-clickhouse | 484-r0 | — |
| Wolfi rolling | wildfly-openjdk-17 +1 | 41.0.0-r2 | — |
| Wolfi rolling | zipkin +1 | 3.6.1-r19 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | at.yawk.lz4:lz4-java | < 1.11.1 | 1.11.1 | GHSA-xx22-p4ch-683r |
| Maven | org.lz4:lz4-java | <= 1.8.1 | — | GHSA-xx22-p4ch-683r |
Advisories 3
- WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-4294 IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 2, 2026
- WID-SEC-2026-3595 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026