CVE-2026-59949

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.1

Description JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments, allowing null arrays or oversized ranges to reach native code. This can lead to reading outside the Java array and a fatal termination of the JVM, resulting in a denial of service. This issue affects applications where an attacker can influence the byte array object or the off and len arguments passed to the affected APIs. It does not affect Java-based XXHash implementations or cases where only the contents of a valid byte array are attacker-controlled.

Recommendations Update to version 1.11.1. As a temporary workaround, avoid passing attacker-controlled array references, offsets, or lengths to JNI-backed XXHash APIs by validating that arrays are non-null and that off and len describe a range fully contained in the array. As a temporary workaround, use XXHashFactory.safeInstance() to avoid the JNI boundary.