Bug 2553532

Summary:	CVE-2026-59949 nqp: lz4-java: Denial of Service via insufficient validation in XXHash JNI implementations [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Avinash Hanwate <ahanwate>
Component:	nqp	Assignee:	Felix Wang <topazus>
Status:	NEW ---	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	rawhide	CC:	gp, topazus
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["60b3bf13-2257-4002-b2f9-70bfc0e06c89"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2510733

Description Avinash Hanwate 2026-10-15 15:05:47 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte array object or the off/len arguments passed to affected XXHash APIs.

The primary risk is denial of service through JVM termination. For oversized-length cases, native code may also read memory outside the Java array before crashing, potentially exposing in-process data.

Affected packages:
- at.yawk.lz4:lz4-java <= 1.11.0
- org.lz4:lz4-java <= 1.8.1

Fixed in at.yawk.lz4:lz4-java 1.11.1.

Workaround: Use XXHashFactory.safeInstance() instead of nativeInstance(), as Java-based XXHash implementations are unaffected. Additionally, validate that arrays are non-null and that offset/length parameters fall within array bounds before calling native XXHash methods.