MEDIUMCVSS 6.5

CVE-2026-59949

CVE-2026-59949 updated by NVD

Published: 2026-07-24
Modified: 2026-09-20
Sources: github-advisory, nvd

Summary

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	at.yawk.lz4:lz4-java	—	1.11.1
Maven	org.lz4:lz4-java	—	—

Remediation: Upgrade to 1.11.1 or later.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-59949

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.