CVE-2026-59949: yawkat lz4-java NULL Pointer Dereference

CVSS: 6.5v3.1MediumDeferred

AliasesUBUNTU-CVE-2026-59949DEBIAN-CVE-2026-59949CGA-234c-93v2-764r+446 more

Published 18-08-2026Last modified 18-08-2026

Vulnerability summary

CVE-2026-59949 is a medium (CVSS 6.5) NULL Pointer Dereference vulnerability in yawkat lz4-java. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39% of scored vulnerabilities.

Overall risk

26/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.47%

0%100%

Low · +0.01 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1

CGA-98MX-FPCM-PJHP

Timeline

18-08-2026
PublishedVulnerability first disclosed.
18-08-2026
Last modifiedVulnerability information updated.

Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.

CVSS metrics

7 scores · 7 sources · 1 version

v3.16.5

EPSS trend

Probability

0.47%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

+0.01 pp

From 0.45% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.47%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.

Affected systems

Chainguard194 products

akhq< 0.27.1-r17
apache-hop< 2.19.0-r0
apache-hop-fips< 2.18.1-r10 | < 2.19.0-r0
apache-nifi< 2.10.0-r10
apache-polaris< 1.7.0-r3

apache-polaris-fips< 1.7.0-r3
apache-pulsar-4.0< 4.0.12-r3
apache-pulsar-4.1All versions (No fix recorded)
apache-pulsar-4.2< 4.2.3-r4
apache-pulsar-fips-4.0< 4.0.12-r3
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-pulsar-fips-4.2< 4.2.3-r3
apicurio-registry< 3.3.0-r13
apicurio-registry-fips< 3.3.0-r10
cassandra-4.0< 4.0.20-r3
cassandra-4.1< 4.1.11-r4
cassandra-5.0< 5.0.8-r13
cassandra-fips-4.0< 4.0.20-r6
cassandra-fips-4.1< 4.1.11-r5
cassandra-fips-5.0< 5.0.8-r8
cassandra-reaper< 5.0.0-r3
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19< 8.19.20-r0
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4< 9.4.5-r0
commercial-elasticsearch-9.5< 9.5.1-r0
conductor< 3.31.0-r7
conductor-fips< 3.31.0-r8
confluent-kafka< 8.4.0.406-r0
confluent-kafka-jre-bcfips< 8.4.0.414-r0
dd-trace-java< 1.65.0-r0
debezium-3.5-connector-jdbc< 3.5.2-r3
debezium-3.5-connector-mariadb< 3.5.2-r3
debezium-3.5-connector-mongodb< 3.5.2-r3
debezium-3.5-connector-mysql< 3.5.2-r3
debezium-3.5-connector-postgres< 3.5.2-r3
debezium-3.5-connector-sqlserver< 3.5.2-r3
debezium-3.6-connector-jdbc< 3.6.1-r1
debezium-3.6-connector-mariadb< 3.6.1-r1
debezium-3.6-connector-mongodb< 3.6.1-r1
debezium-3.6-connector-mysql< 3.6.1-r1
debezium-3.6-connector-postgres< 3.6.1-r1
debezium-3.6-connector-sqlserver< 3.6.1-r1
debezium-connector-db2-3.5< 3.5.2-r2
debezium-connector-db2-3.6< 3.6.0-r1
debezium-connector-ibmi-3.5< 3.5.2-r5
debezium-connector-ibmi-3.6< 3.6.1-r1
debezium-connector-informix-3.5< 3.5.2-r4
debezium-connector-informix-3.6< 3.6.0-r1
debezium-connector-spanner-3.3< 3.3.2-r7
debezium-connector-spanner-3.4< 3.4.3-r4
debezium-connector-spanner-3.5< 3.5.2-r5 | < 3.5.2-r6
debezium-connector-spanner-3.6< 3.6.0-r1
debezium-connector-vitess-3.5< 3.5.2-r2
debezium-connector-vitess-3.6< 3.6.0-r2
dependency-track-apiserver-5< 5.0.4-r1
druid< 37.0.0-r56 | < 37.0.0-r48
elasticsearch-8.19< 8.19.19-r2
elasticsearch-8.19-iamguarded< 8.19.19-r2
elasticsearch-8.19-iamguarded-fips< 8.19.19-r2
elasticsearch-9.1All versions (No fix recorded)
elasticsearch-9.1-iamguardedAll versions (No fix recorded)
elasticsearch-9.1-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.2< 9.2.8-r21
elasticsearch-9.2-iamguarded< 9.2.8-r13
elasticsearch-9.2-iamguarded-fips< 9.2.8-r20
elasticsearch-9.3< 9.3.8-r15
elasticsearch-9.3-iamguarded< 9.3.8-r6
elasticsearch-9.3-iamguarded-fips< 9.3.8-r7
elasticsearch-9.4< 9.4.4-r2
elasticsearch-9.4-iamguarded< 9.4.4-r2
elasticsearch-9.4-iamguarded-fips< 9.4.4-r2
elasticsearch-9.5-iamguarded-fips< 9.5.1-r0
elasticsearch-fips-8.19< 8.19.19-r2
elasticsearch-fips-9.1All versions (No fix recorded)
elasticsearch-fips-9.2< 9.2.8-r20
elasticsearch-fips-9.3< 9.3.8-r7
elasticsearch-fips-9.4< 9.4.4-r2
flink-kubernetes-operator< 1.16.1-r0
flink-kubernetes-operator-fips< 1.16.1-r1
floci< 1.5.34-r1
flyway< 13.7.0-r1
hadoop-fips-3.3.6< 3.3.6-r26
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r3
hono-adapter-mqtt< 2.7.0-r34
hono-cli< 2.7.0-r34
hono-service-command-router< 2.7.0-r34
hono-service-device-registry-jdbc< 2.7.0-r34
kafbat-ui< 1.5.0-r11
kafbat-ui-fips< 1.5.0-r6
kafka_exporter-strimzi-compat< 1.2.0-r4 | < 1.2.0-r5
kafka-3.7< 3.7.2-r63
kafka-3.8< 3.8.1-r60
kafka-3.9< 3.9.2-r11
kafka-4.0< 4.0.2-r8
kafka-4.1< 4.1.2-r6
kafka-4.2< 4.2.1-r6
kafka-4.3-oci-compatAll versions (No fix recorded)
kafka-4.3-openjdk-17< 4.3.1-r6
kafka-4.3-openjdk-21< 4.3.1-r6
kafka-4.3-openjdk-25< 4.3.1-r6
kafka-bridge< 1.0.0-r10
kafka-bridge-fips< 1.0.0-r7
kafka-fips-4.1< 4.1.2-r7
kafka-fips-4.2< 4.2.1-r6
kafka-fips-4.3< 4.3.1-r5
kafka-strimzi-compat< 1.2.0-r5
kayenta-2026.3< 2026.3.5-r3
kayenta-fips-2026.3< 2026.3.5-r3
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r22
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r22
knative-kafka-broker-1.21-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-1.21-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-1.22-dispatcher-loom< 1.22.3-r5
knative-kafka-broker-1.22-receiver-loom< 1.22.3-r5
knative-kafka-broker-1.23-dispatcher-loom< 1.23.0-r1
knative-kafka-broker-1.23-receiver-loom< 1.23.0-r1
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r20
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r20
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.5-r11
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.5-r12 | < 1.21.5-r11
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.3-r1
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.3-r1
logstash-8.19< 8.19.23-r1 | < 8.19.19-r3
logstash-8.19-iamguarded-compat< 8.19.23-r1 | < 8.19.19-r3
logstash-8.19-with-output-opensearch< 8.19.23-r1 | < 8.19.19-r3
logstash-9.2< 9.2.8-r10
logstash-9.2-iamguarded-compat< 9.2.8-r10
logstash-9.2-with-output-opensearch< 9.2.8-r10
logstash-9.3< 9.3.8-r3
logstash-9.3-iamguarded-compat< 9.3.8-r3
logstash-9.4< 9.4.5-r3
logstash-9.4-iamguarded-compat< 9.4.5-r3
logstash-9.5< 9.5.1-r2
logstash-9.5-iamguarded-compat< 9.5.1-r2
logstash-fips-9.4< 9.4.5-r3
logstash-fips-9.4-iamguarded-compat< 9.4.5-r3
logstash-fips-9.5< 9.5.0-r1
logstash-fips-9.5-iamguarded-compat< 9.5.0-r1
metabase< 0.63.2-r3
nuxeo-2023< 2023.45-r5
opensearch-2-security< 2.19.6-r6
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-security< 3.7.0-r13
opensearch-fips-3-security< 3.7.0-r12
pinot< 1.5.1-r10
pinot-fips< 1.5.1-r7
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
seata-server< 2.7.0-r3
sonarqube< 26.8.0.126808-r1 | < 26.7.0.124771-r3
spark-3.5-scala-2.12< 3.5.9-r2
spark-3.5-scala-2.13< 3.5.9-r2
spark-4.0-scala-2.13< 4.0.4-r1
spark-4.1-scala-2.13< 4.1.3-r2
spark-4.2-scala-2.13< 4.2.0-r4
spark-fips-3.5-scala-2.12< 3.5.8-r6
spark-fips-3.5-scala-2.13< 3.5.8-r6
spark-fips-4.1-scala-2.13< 4.1.2-r6
spark-fips-4.2-scala-2.13< 4.2.0-r3
spark-kubernetes-operator< 0.9.0-r7
spark-kubernetes-operator-fips< 1.0.0-r0
strimzi-kafka-operator< 1.2.0-r5
strimzi-kafka-operator-cluster-operator< 1.2.0-r5 | < 1.2.0-r4 | < 1.1.0-r4
strimzi-kafka-operator-fips-cluster-operator< 1.1.0-r1
strimzi-kafka-operator-fips-kafka-agent< 1.1.0-r1
strimzi-kafka-operator-fips-kafka-init< 1.1.0-r1
strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc< 1.1.0-r1
strimzi-kafka-operator-fips-topic-operator< 1.1.0-r1
strimzi-kafka-operator-fips-tracing-agent< 1.1.0-r1
strimzi-kafka-operator-fips-user-operator< 1.1.0-r1
strimzi-kafka-operator-kafka-agent< 1.1.0-r4 | < 1.2.0-r5
strimzi-kafka-operator-kafka-base< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-kafka-init< 1.2.0-r5 | < 1.1.0-r4 | < 1.2.0-r4
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.2.0-r5 | < 1.1.0-r4
strimzi-kafka-operator-topic-operator< 1.2.0-r5 | < 1.1.0-r4 | < 1.2.0-r4
strimzi-kafka-operator-tracing-agent< 1.1.0-r4 | < 1.2.0-r5
strimzi-kafka-operator-user-operator< 1.2.0-r5 | < 1.1.0-r4
thingsboard-tb-mqtt-transport< 4.3.1.3-r13
thingsboard-tb-node< 4.3.1.3-r13
traccar< 6.14.5-r2
traccar-fips< 6.14.5-r4
trino-plugin-clickhouseAll versions (No fix recorded)
wazuh-indexer-plugin-security< 4.14.7-r1
wildfly-openjdk-17< 41.0.0-r2
wildfly-openjdk-21< 41.0.0-r2
zipkin< 3.6.1-r19
zipkin-slim< 3.6.1-r19

Show all 194

Wolfi6 products

akhq< 0.27.1-r17
apache-nifi< 2.10.0-r10
apache-pulsar-4.1All versions (No fix recorded)
apache-pulsar-4.2< 4.2.3-r4
apicurio-registry< 3.3.0-r13

Show all 6

2 vendors · 200 products · Showing 200 of 267. Use Open JSON for the complete list.

References

9 links

github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683rX Refsource CONFIRMREPORTAdvisoryWEB
github.com/yawkat/lz4-java/commit/dbd86d04b8dd716e1c2bc626be54189997d910daX Refsource MISCFIXWEB
github.com/yawkat/lz4-java/releases/tag/v1.11.1X Refsource MISCWEB
ubuntu.com/security/CVE-2026-59949REPORT
www.cve.org/CVERecord?id=CVE-2026-59949REPORT
security-tracker.debian.org/tracker/CVE-2026-59949Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59949.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-59949Advisory
github.com/yawkat/lz4-javaPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities