{"id":"OESA-2026-4077","summary":"lz4-java security update","details":"LZ4 compression for Java, based on Yann Collet's work. This library provides access to two compression methods that both generate a valid LZ4 stream: * fast scan (LZ4):     ° low memory footprint (~ 16 KB),     ° very fast (fast scan with skipping heuristics in case the       input looks incompressible),     ° reasonable compression ratio (depending on the       redundancy of the input). * high compression (LZ4 HC):     ° medium memory footprint (~ 256 KB),     ° rather slow (~ 10 times slower than LZ4),     ° good compression ratio (depending on the size and       the redundancy of the input). The streams produced by those 2 compression algorithms use the same compression format, are very fast to decompress and can be decompressed by the same decompressor instance.\r\n\r\nSecurity Fix(es):\n\nyawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.(CVE-2026-59949)","modified":"2026-09-25T01:45:12.080330199Z","published":"2026-09-25T01:28:09Z","upstream":["CVE-2026-59949"],"database_specific":{"severity":"Medium"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4077"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59949"}],"affected":[{"package":{"name":"lz4-java","ecosystem":"openEuler:24.03-LTS-SP1","purl":"pkg:rpm/openEuler/lz4-java&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-3.oe2403sp1"}]}],"ecosystem_specific":{"noarch":["lz4-java-javadoc-1.8.0-3.oe2403sp1.noarch.rpm"],"src":["lz4-java-1.8.0-3.oe2403sp1.src.rpm"],"x86_64":["lz4-java-1.8.0-3.oe2403sp1.x86_64.rpm"],"aarch64":["lz4-java-1.8.0-3.oe2403sp1.aarch64.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-4077.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H"}]}