yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail
    to validate the byte array object and the off and len arguments in
    XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(),
    XXHashFactory.nativeInstance().newStreamingHash32().update(), and
    XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to
    reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in
    version 1.11.1. (CVE-2026-59949)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail     to validate the byte array object and the off and len arguments in     XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(),     XXHashFactory.nativeInstance().newStreamingHash32().update(), and     XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to     reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in     version 1.11.1. (CVE-2026-59949)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
459534	Echo: at.yawk.lz4:lz4-java: security update to 1.11.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
459534	Echo: at.yawk.lz4:lz4-java: security update to 1.11.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
338278	Linux Distros Unpatched Vulnerability : CVE-2026-59949	Nessus	Misc.	Local	medium
445288	SCA: security update for at.yawk.lz4:lz4-java (GHSA-xx22-p4ch-683r)	Tenable Cloud Security	SCA Checks	Local	medium
445288	SCA: security update for at.yawk.lz4:lz4-java (GHSA-xx22-p4ch-683r)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-59949

medium

Tenable Plugins

medium

medium

medium

medium

medium