Description
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.
Published: 2026-08-18
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Yawkat LZ4 Java implements LZ4 compression for Java and includes native XXHash hashing. Prior to version 1.11.1 the native code does not validate the byte array, offset, and length parameters supplied to hash functions. Passing a null array or an oversized range allows the JVM to read beyond the bounds of the Java array in native code, which results in a fatal JVM crash. The exploit does not provide arbitrary code execution; instead it causes the Java application to terminate abruptly, leading to loss of availability for anyone relying on the library.

Affected Systems

The vulnerability affects the yawkat lz4-java library, specifically any installation of the library prior to version 1.11.1. All Java applications that depend on this library and use the native XXHash functions are impacted.

Risk and Exploitability

The CVSS score for this vulnerability is 6.5, indicating a moderate severity. There is no EPSS data available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local or through any application that uses the library; an attacker would need to supply a crafted byte array to the hash functions which would be executed within the JVM context.

Generated by OpenCVE AI on August 18, 2026 at 16:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Install lz4-java version 1.11.1 or newer to receive the bug fix
  • Configure applications to validate input arrays and prevent null or oversized ranges before invoking native XXHash functions
  • If an update is not feasible, replace calls to the native XXHash implementation with the pure‑Java alternative provided by the library

Generated by OpenCVE AI on August 18, 2026 at 16:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-xx22-p4ch-683r LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges
History

Fri, 21 Aug 2026 13:00:00 +0000

Type Values Removed Values Added
First Time appeared Yawkat
Yawkat lz4-java
Vendors & Products Yawkat
Yawkat lz4-java

Tue, 18 Aug 2026 15:15:00 +0000

Type Values Removed Values Added
Description yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.
Title yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash JNI (StreamingXXHash32JNI / StreamingXXHash64JNI)
Weaknesses CWE-476
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H'}

Subscriptions

Yawkat Lz4-java
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-08-18T17:46:55.526Z

Reserved: 2026-07-07T18:49:15.607Z

Link: CVE-2026-59949

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-18T15:16:56.160

Modified: 2026-08-18T18:18:49.860

Link: CVE-2026-59949

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-21T12:33:06Z

Weaknesses