CVE-2026-32829: CWE-201: Insertion of Sensitive Information Into Sent Data in PSeitz lz4_flex
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.
AI Analysis
Technical Summary
CVE-2026-32829 describes a vulnerability in the lz4_flex Rust compression library where decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or previous decompression operations. This occurs because the library fails to properly validate offset values during LZ4 match copy operations, allowing out-of-bounds reads from the output buffer. The affected functions are block-based API functions such as decompress_into and decompress_into_with_dict when the safe-decode feature is disabled. Frame APIs are not affected. The vulnerability is resolved in versions 0.11.6 and 0.12.1 of the library.
Potential Impact
Exploitation of this vulnerability can lead to exposure of sensitive data and secrets from memory during decompression of maliciously crafted LZ4 input. This could compromise confidentiality by leaking information from uninitialized or previously processed memory buffers. The vulnerability does not affect frame APIs and requires use of block-based APIs with safe-decode disabled.
Mitigation Recommendations
An official fix is available. Users should upgrade lz4_flex to version 0.11.6 or later, or 0.12.1 or later, to remediate this vulnerability. Avoid using block-based API functions with safe-decode disabled on untrusted input until patched. Consult the vendor advisories linked for detailed update instructions.
CVE-2026-32829: CWE-201: Insertion of Sensitive Information Into Sent Data in PSeitz lz4_flex
Description
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.
CVSS v4.0
Score 8.2high
Affected software
pkg:cargo/github/PSeitz/lz4_flexRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-32829 describes a vulnerability in the lz4_flex Rust compression library where decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or previous decompression operations. This occurs because the library fails to properly validate offset values during LZ4 match copy operations, allowing out-of-bounds reads from the output buffer. The affected functions are block-based API functions such as decompress_into and decompress_into_with_dict when the safe-decode feature is disabled. Frame APIs are not affected. The vulnerability is resolved in versions 0.11.6 and 0.12.1 of the library.
Potential Impact
Exploitation of this vulnerability can lead to exposure of sensitive data and secrets from memory during decompression of maliciously crafted LZ4 input. This could compromise confidentiality by leaking information from uninitialized or previously processed memory buffers. The vulnerability does not affect frame APIs and requires use of block-based APIs with safe-decode disabled.
Mitigation Recommendations
An official fix is available. Users should upgrade lz4_flex to version 0.11.6 or later, or 0.12.1 or later, to remediate this vulnerability. Avoid using block-based API functions with safe-decode disabled on untrusted input until patched. Consult the vendor advisories linked for detailed update instructions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-16T17:35:36.698Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-32829","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:11800","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:22862","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:16354","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:19712","vendor":"Red Hat"}]
Threat ID: 69bc9abfe32a4fbe5f103102
Added to database: 03/20/2026, 00:54:23 UTC
Last enriched: 07/15/2026, 08:56:54 UTC
Last updated: 08/01/2026, 19:17:59 UTC
Views: 239
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.