org.lz4:lz4-java vulnerabilities
CVEs whose affected-version data names the org.lz4:lz4-java package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-106451High· 7.3yawkat LZ4 Java provides LZ4 compression for Java
yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, th…
▾ Twilightyawk · at.yawk.lz4:lz4-javaEPSS 0.11%via NVD
CVE-2026-59949Medium· 6.5yawkat LZ4 Java provides LZ4 compression for Java
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.n…
▾ Sunlityawk · at.yawk.lz4:lz4-javaEPSS 0.47%via NVD