LZ4 Compression Vulnerability in Yawkat's Java Implementation
CVE-2026-59949

6.5MEDIUM

Key Information:

Vendor

Yawkat

Status
Lz4-java
Vendor
CVE Published:
18 August 2026

What is CVE-2026-59949?

Yawkat's LZ4 Java implementation suffers from a critical vulnerability in its JNI-backed XXHash methods. Prior to version 1.11.1, the functions for hashing and streaming hash generation did not properly validate input parameters. This oversight allows malformed byte arrays or excessively large ranges to be processed, potentially leading to access violations that can crash the Java Virtual Machine. Users are advised to upgrade to version 1.11.1 to mitigate these risks.

Affected Version(s)

lz4-java < 1.11.1

References

https://github.com/yawkat/lz4-java/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/yawkat/lz4-java/commit/dbd86d04b8dd716...
x_refsource_MISC
https://github.com/yawkat/lz4-java/releases/tag/v1.11.1
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.