Homepage

at.yawk.lz4:lz4-java@1.11.3

  • latest version

    1.12.0

  • latest non vulnerable version

    1.12.0

  • first published

    11 months ago

  • latest version published

    26 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the at.yawk.lz4:lz4-java package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Uncontrolled Recursion

    Affected versions of this package are vulnerable to Uncontrolled Recursion in the refill function when processing LZ4 block streams with stopOnEmptyBlock set to false. An attacker can cause a thread to terminate unexpectedly by providing a stream with a large number of consecutive empty blocks, leading to stack exhaustion and application unavailability. This is only exploitable if the configuration option stopOnEmptyBlock is explicitly set to false.

    How to fix Uncontrolled Recursion?

    Upgrade at.yawk.lz4:lz4-java to version 1.11.4 or higher.

    [,1.11.4)
    • H
    Allocation of Resources Without Limits or Throttling

    Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through repeated allocation of large buffers in the LZ4FrameInputStream.readHeader process. An attacker can cause excessive CPU and garbage collection usage by providing specially crafted input consisting of many minimal empty frames, leading to significant resource consumption relative to the input size.

    How to fix Allocation of Resources Without Limits or Throttling?

    Upgrade at.yawk.lz4:lz4-java to version 1.11.4 or higher.

    [,1.11.4)
    • H
    Insecure Temporary File

    Affected versions of this package are vulnerable to Insecure Temporary File in the process that extracts and loads the native library via net.jpountz.util.Native.load. An attacker can execute arbitrary code by pre-creating a malicious file in a shared temporary directory, causing the victim process to load attacker-controlled code. This is only exploitable if the temporary directory is shared and writable by multiple users, and system protections such as fs.protected_regular or fs.protected_symlinks are not enabled, or if the temporary directory lacks the sticky bit or is shared across users in containers.

    How to fix Insecure Temporary File?

    Upgrade at.yawk.lz4:lz4-java to version 1.11.4 or higher.

    [,1.11.4)
    Go back to all versions of this package