CVE-2026-106451High· 7.3▾ Twilightyawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, th…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.08%
0.08% → 0.1%
yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
at.yawk.lz4:lz4-java <= 1.11.3org.lz4:lz4-java >= 1.7.0, <= 1.8.1Patched in:
at.yawk.lz4:lz4-java 1.11.4Source: https://github.com/advisories/GHSA-mcr4-qmvw-px4g
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-105481Medium· 6.5nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse (CVE-2026-105481)
CVE-2026-112940High· 7.1filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process over…
CVE-2026-68338High· 7.0kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)
CVE-2026-53145High· 7.8drm/gem: Try to fix change_handle ioctl, attempt 4
CVE-2026-31678High· 7.8kernel: openvswitch: defer tunnel netdev_put to RCU release (CVE-2026-31678)
CVE-2025-38440High· 7.8In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race between DIM disable and net_dim() There's a race between disabling DIM and NAPI callbacks using the dim pointer on the RQ or SQ. If NAPI checks th…