CVE-2026-32829: pseitz lz4_flex
Vulnerability summary
CVE-2026-32829 is a high (CVSS 8.2) vulnerability in pseitz lz4_flex. EPSS estimates a 0.72% chance of exploitation in the next 30 days, higher than 53.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 20-03-2026PublishedVulnerability first disclosed.
- 17-09-2026Last modifiedVulnerability information updated.
Description
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.
CVSS metrics
10 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · Crates.ioEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST8.2HighCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.72%
Chance of exploitation in the next 30 days
Percentile
53%
Versus all other CVEs
30-day change
+0.11 pp
From 0.61% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-201Insertion of Sensitive Information Into Sent DataThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
- CWE-823Use of Out-of-range Pointer OffsetThe product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
Affected systems
Chainguard9 products
- garage-1< 1.3.1-r3
- garage-2< 2.2.0-r2
- garage-2.2< 2.2.0-r3
- parseable< 2.6.1-r1
- py3.10-hf-xet< 1.4.2-r1
Wolfi6 products
- parseable< 2.6.1-r1
- py3.10-hf-xet< 1.4.2-r1
- py3.11-hf-xet< 1.4.2-r1
- py3.13-hf-xet< 1.4.2-r1
- qdrant< 1.17.0-r5
Crates.Io1 product
- lz4_flex< 0.11.6 | ≥ 0.12.0, < 0.12.1
Debian1 product
- rust-lz4-flexAll versions (No fix recorded) | < 0.13.0-1
Pseitz1 product
- lz4_flex≥ 0.12.0, < 0.12.1 | < 0.11.6 | 0.12.0
Ubuntu1 product
- rust-lz4-flexAll versions (No fix recorded)
6 vendors · 19 products
References
18 links- github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvvX Refsource CONFIRMAdvisoryWEBMitigationVendor Advisory
- github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6dX Refsource MISCFIXWEBPatch
Show all 18 references
- github.com/PSeitz/lz4_flexPACKAGE
- crates.io/crates/lz4_flexPACKAGE