SB2026080725 - Multiple vulnerabilities in lz4-java

Description

This security bulletin contains information about 2 vulnerabilities.

1) Uncontrolled Memory Allocation (CVE-ID: N/A)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value in LZ4BlockInputStream refill() when processing a crafted legacy LZ4Block stream header. A remote attacker can supply a header with an oversized compressed length value to cause a denial of service.

No valid compressed payload is required for exploitation.

2) Uncontrolled Memory Allocation (CVE-ID: N/A)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value in LZ4DecompressorWithLength.decompress(byte[], int) and similar with-length convenience decompression overloads when processing attacker-supplied LZ4 data with a forged 4-byte length header. A remote attacker can send a specially crafted 5-byte input to cause a denial of service.

The issue is specific to convenience overloads that derive the destination length from the input header rather than using a caller-supplied buffer.

Remediation

Install update from vendor's website.

References

• https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464
• https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g