yawkat LZ4 Java provides LZ4 compression for Java. (CVE-2026-59949)
Description
A vulnerability in yawkat LZ4 Java prior to version 1.11.1 allows improper validation of byte array objects and offset/length arguments in JNI-backed XXHash implementations. This can lead to reading outside the Java array bounds and cause the JVM to crash. The issue is fixed in version 1.11.1.
CVSS v3.1
Score 6.5medium
Affected software
pkg:deb/ubuntu/lz4-java?arch=source&distro=focalpkg:deb/ubuntu/lz4-java?arch=source&distro=jammypkg:deb/ubuntu/lz4-java?arch=source&distro=noblepkg:deb/ubuntu/lz4-java?arch=source&distro=resolutepkg:rpm/openEuler/lz4-java&distro=openEuler-24.03-LTS-SP4pkg:deb/ubuntu/lz4-java?arch=source&distro=stonkingRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
yawkat LZ4 Java provides LZ4 compression for Java applications. Versions prior to 1.11.1 contain a vulnerability in the JNI-backed XXHash implementations where the byte array object and the offset and length arguments are not properly validated in several hash methods. This allows null arrays or oversized ranges to be passed to native code, resulting in out-of-bounds reads and fatal JVM termination. The vulnerability is addressed in version 1.11.1.
Potential Impact
The vulnerability can cause a denial of service by crashing the JVM due to out-of-bounds memory access when invalid parameters are passed to the native XXHash functions. There is no indication of confidentiality or integrity impact, but availability is affected due to JVM termination.
Mitigation Recommendations
Upgrade to yawkat LZ4 Java version 1.11.1 or later, where the issue is fixed by proper validation of input parameters in the JNI-backed XXHash implementations.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- CLEANSTART-2026-LI34904
- Osv Schema Version
- 1.7.3
- Ecosystems
- ["Alpine"]
- State
- PUBLISHED
Threat ID: 6a984555acd9273b496ab748
Added to database: 09/02/2026, 15:48:37 UTC
Last enriched: 10/18/2026, 04:33:04 UTC
Last updated: 10/18/2026, 18:48:22 UTC
Views: 38
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.