Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:16:56.160Z",
  "pubdate": "2026-08-18T15:16:56.160Z",
  "executiveSummary": "A critical vulnerability exists in the yawkat LZ4 Java library prior to version 1.11.1, specifically within the JNI-backed XXHash implementations.\nThe flaw involves missing validation of byte array objects, offsets, and length arguments in critical hashing functions.\nThis vulnerability allows an attacker to supply null arrays or oversized ranges that propagate directly to native code.\nSuccessful exploitation results in out-of-bounds memory reads outside the allocated Java array boundaries, causing a fatal JVM termination leading to a denial of service.\nThe affected systems include any Java applications utilizing the native XXHash implementations of the yawkat LZ4 Java library.\nThe risk implication is primarily service disruption through application crashes, as the native memory access violation forces the Java Virtual Machine to abort.\nNo specific authentication or network exposure is inherently required beyond the ability to invoke the vulnerable API methods with malicious or malformed parameters.",
  "technicalDetails": "The vulnerability resides in the JNI-backed XXHash implementations exposed by the yawkat LZ4 Java library.\nSpecifically, the vulnerable functions include XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update().\nThe root cause is inadequate input validation within the Java wrapper layer before invoking native methods.\nThe implementation fails to validate the provided byte array object, as well as the off and len arguments, allowing invalid parameters such as null arrays or out-of-bounds offset and length combinations to bypass initial checks.\nWhen these unvalidated parameters reach the underlying native code, the JNI layer attempts to read memory based on the supplied pointers and bounds without safety guards.\nThe step-by-step attack flow begins when an application processes untrusted input or constructs malicious parameters designed to target the vulnerable update or hash methods.\nThe attacker passes a null array or an oversized range where the offset and length exceed the actual capacity of the target byte array.\nBecause the Java layer does not intercept or reject these malformed arguments, the execution flow transfers control directly to the native C/C++ JNI implementation.\nThe native code proceeds to dereference the memory addresses or compute offsets based on the attacker-controlled values.\nThis results in an out-of-bounds memory read operation, attempting to access memory regions outside the valid bounds of the Java array buffer.\nThe memory access violation triggers a fatal segmentation fault or equivalent low-level crash within the native runtime environment.\nConsequently, the operating system or runtime catches the invalid memory access and fatally terminates the JVM, resulting in an immediate denial of service for the host application.\nThe affected versions comprise all releases of yawkat LZ4 Java prior to version 1.11.1."
}