CyberRota Analysis
AI-GeneratedThe yawkat LZ4 Java library prior to version 1.11.1 is vulnerable due to insufficient validation of byte array objects and their associated parameters in multiple native methods, which can lead to null arrays or oversized ranges being processed. This flaw allows attackers to exploit the vulnerability, potentially leading to JVM crashes and application instability. Java developers and organizations utilizing this library should prioritize upgrading to version 1.11.1 to mitigate the risk of application failures.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.