OESA-2026-4078

LZ4 compression for Java, based on Yann Collet's work. This library provides access to two compression methods that both generate a valid LZ4 stream: * fast scan (LZ4): ° low memory footprint (~ 16 KB), ° very fast (fast scan with skipping heuristics in case the input looks incompressible), ° reasonable compression ratio (depending on the redundancy of the input). * high compression (LZ4 HC): ° medium memory footprint (~ 256 KB), ° rather slow (~ 10 times slower than LZ4), ° good compression ratio (depending on the size and the redundancy of the input). The streams produced by those 2 compression algorithms use the same compression format, are very fast to decompress and can be decompressed by the same decompressor instance.

Security Fix(es):

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.(CVE-2026-59949)