lz4-java vulnerabilities

2 known vulnerabilities in lz4-java from Yawkat. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.3 High severity

  lz4-java: Time-of-check Time-of-use (TOCTOU) Race Condition

  CVE-2026-106451Oct 6, 2026Yawkat

  yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream ope

• 8.2 High severity

  lz4-java: Insertion of Sensitive Information Into Sent Data

  CVE-2025-66566Dec 5, 2025Yawkat

  yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In ap