yawkat/lz4-java Security Advisories | GitStock

high2026-10-07

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

GHSA-mcr4-qmvw-px4g · CVE-2026-106451

low2026-10-07

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

GHSA-343h-94h5-c4wr · CVE-2026-106449

medium2026-10-07

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

GHSA-gm45-99xc-r7wv · CVE-2026-106450

medium2026-10-07

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

GHSA-4v53-57pg-c464 · CVE-2026-106452

medium2026-10-07

yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

GHSA-6cx8-rjf8-pr8g · CVE-2026-106453

medium2026-07-24

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

GHSA-xx22-p4ch-683r · CVE-2026-59949

high2025-12-05

yawkat LZ4 Java has a possible information leak in Java safe decompressor

GHSA-cmp6-m4wj-q63q · CVE-2025-66566

high2025-11-28

LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

GHSA-vqf4-7m7x-wgfc · CVE-2025-12183