{"id":"CVE-2026-59949","title":"yawkat LZ4 Java provides LZ4 compression for Java","summary":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.n…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H","cwe":["CWE-476","CWE-125"],"vendor":"yawk","product":"at.yawk.lz4:lz4-java","affected":["at.yawk.lz4:lz4-java <= 1.11.0","org.lz4:lz4-java <= 1.8.1"],"patched":["at.yawk.lz4:lz4-java 1.11.1"],"published":"2026-08-18","updated":"2026-09-18","sourceUpdated":"2026-09-18T20:09:01.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59949","references":[{"url":"https://github.com/yawkat/lz4-java/commit/dbd86d04b8dd716e1c2bc626be54189997d910da","label":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.1","label":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-xx22-p4ch-683r"}],"tags":["nvd","ghsa","maven"],"epss":0.00453,"epssPercentile":0.38555,"aliases":["GHSA-xx22-p4ch-683r"],"ecosystem":"maven","ingestedAt":"2026-07-24T16:33:09.611Z","slug":"CVE-2026-59949","body":"## Overview\n\nyawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-59949)\n\nAffected packages:\n\n- `at.yawk.lz4:lz4-java <= 1.11.0`\n- `org.lz4:lz4-java <= 1.8.1`\n\nPatched in:\n\n- `at.yawk.lz4:lz4-java 1.11.1`\n\nSource: https://github.com/advisories/GHSA-xx22-p4ch-683r","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}