Medium severity · published Aug 18, 2026
CVE-2026-59949
yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash JNI (StreamingXXHash32JNI / StreamingXXHash64JNI)
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LZ
lz4-java · yawkat
< 1.11.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59949
github.com
https://github.com/yawkat/lz4-java/commit/dbd86d04b8dd716e1c2bc626be54189997d910da
github.com
https://github.com/yawkat/lz4-java/releases/tag/v1.11.1
github.com
https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r
More from lz4-java
8.2
CVE-2025-66566
yawkat LZ4 Java has a possible information leak in Java safe decompressor
7.3
CVE-2026-106451
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
5.3
CVE-2026-106453
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError
5.3
CVE-2026-106452
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header
5.3
CVE-2026-106450
yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs