Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte array object or the off/len arguments passed to affected XXHash APIs.

The primary risk is denial of service through JVM termination. For oversized-length cases, native code may also read memory outside the Java array before crashing, potentially exposing in-process data.

Affected packages:
- at.yawk.lz4:lz4-java <= 1.11.0
- org.lz4:lz4-java <= 1.8.1

Fixed in at.yawk.lz4:lz4-java 1.11.1.

Workaround: Use XXHashFactory.safeInstance() instead of nativeInstance(), as Java-based XXHash implementations are unaffected. Additionally, validate that arrays are non-null and that offset/length parameters fall within array bounds before calling native XXHash methods.