CVE-2026-59949: LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

July 24, 2026

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods.

This affects applications where an attacker can influence the byte array object or the off / len arguments passed to affected XXHash APIs. It does not affect the common case where only the contents of a valid byte array are attacker-controlled.

Java-based XXHash implementations are not affected.

References

github.com/advisories/GHSA-xx22-p4ch-683r
github.com/yawkat/lz4-java/commit/dbd86d04b8dd716e1c2bc626be54189997d910da
github.com/yawkat/lz4-java/releases/tag/v1.11.1
github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r
nvd.nist.gov/vuln/detail/CVE-2026-59949

Code Behaviors & Features

Detect and mitigate CVE-2026-59949 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →