CVE-2026-59949 LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges
Attackers can crash the JVM by passing null arrays or invalid ranges to JNI-backed XXHash functions in the lz4-java library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59949?
CVE-2026-59949 is a medium-severity vulnerability in yawkat lz4-java, published on 18 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.
Weakness: CWE-476
Which versions are affected by CVE-2026-59949?
4 open source packages ship an affected version, including at.yawk.lz4:lz4-java and org.lz4:lz4-java.
| Package | Affected | Fixed in |
|---|---|---|
at.yawk.lz4:lz4-java Maven | All versions | 1.11.1 |
at.yawk.lz4:lz4-java Maven | All versions | 1.11.1 |
org.lz4:lz4-java Maven | All versions to 1.8.1 | None |
org.lz4:lz4-java Maven | All versions to 1.8.1 | None |
How do I fix CVE-2026-59949?
Upgrade at.yawk.lz4:lz4-java to 1.11.1 or later.
Is CVE-2026-59949 being exploited?
There is no known exploitation of CVE-2026-59949 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-GP40817, CLEANSTART-2026-IG77090, CLEANSTART-2026-JC19779, CLEANSTART-2026-LJ57058, CLEANSTART-2026-MY27015, CLEANSTART-2026-UF96774 and 74 more.