CVE-2026-59949

MediumCVSS 6.5

Published: 18/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 18/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.46%

38th percentile - higher than 38% of all known CVEs

Summary

In yawkat LZ4 Java before version 1.11.1, JNI-backed XXHash functions fail to validate the byte array and off/len arguments, allowing null arrays or oversized ranges to reach native code. This can cause reads outside the Java array and fatal JVM termination. Fixed in version 1.11.1.

Risk Assessment

An attacker can cause a Java application crash (denial of service) by invoking vulnerable functions with invalid arguments. This may disrupt critical services.

Recommendation

Upgrade yawkat LZ4 Java to version 1.11.1 or later, which includes the fix.

Original NVD description (English source)

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.