Source: lz4-java Version: 1.8.0-4 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for lz4-java. CVE-2026-59949[0]: | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, | JNI-backed XXHash implementations fail to validate the byte array | object and the off and len arguments in | XXHashFactory.nativeInstance().hash32().hash(), | XXHashFactory.nativeInstance().hash64().hash(), | XXHashFactory.nativeInstance().newStreamingHash32().update(), and | XXHashFactory.nativeInstance().newStreamingHash64().update(), | allowing null arrays or oversized ranges to reach native code, read | outside the Java array, and fatally terminate the JVM. This issue is | fixed in version 1.11.1. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-59949 https://www.cve.org/CVERecord?id=CVE-2026-59949 [1] https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r [2] https://github.com/yawkat/lz4-java/commit/dbd86d04b8dd716e1c2bc626be54189997d910da Regards, Salvatore __ This is the maintainer address of Debian's Java team <https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>. Please use [email protected] for discussions and questions.
