From 230054ef8f7b40a2b959d0f1efc720ed582aabf5 Mon Sep 17 00:00:00 2001 From: Lari Hotari Date: Mon, 31 Aug 2026 12:15:01 +0300 Subject: [PATCH] [fix][sec][branch-4.x] Upgrade lz4-java to 1.11.2 Upgrades at.yawk.lz4:lz4-java from 1.11.1 to 1.11.2, a security-only release that fixes two moderate (CVSS 5.3, CWE-789) unvalidated allocation issues: - GHSA-6cx8-rjf8-pr8g: LZ4DecompressorWithLength.decompress(byte[], int) passes the unvalidated 4-byte length header straight to LZ4FastDecompressor.decompress(byte[], int, int), which allocates the declared size before reading any payload. A 5-byte input can force up to a 2 GiB allocation. - GHSA-4v53-57pg-c464: LZ4BlockInputStream.refill() grows its input buffer to the attacker-controlled compressedLen from the block header before reading the payload. master is already on 1.11.2; this is the branch-4.x port. Release notes: https://github.com/yawkat/lz4-java/releases/tag/v1.11.2 --- distribution/server/src/assemble/LICENSE.bin.txt | 2 +- pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/distribution/server/src/assemble/LICENSE.bin.txt b/distribution/server/src/assemble/LICENSE.bin.txt index 3bafc226ade3f..27029234ac168 100644 --- a/distribution/server/src/assemble/LICENSE.bin.txt +++ b/distribution/server/src/assemble/LICENSE.bin.txt @@ -383,7 +383,7 @@ The Apache Software License, Version 2.0 - org.apache.bookkeeper-bookkeeper-slogger-api-4.17.4.jar - org.apache.bookkeeper-bookkeeper-slogger-slf4j-4.17.4.jar - org.apache.bookkeeper-native-io-4.17.4.jar - - at.yawk.lz4-lz4-java-1.11.1.jar + - at.yawk.lz4-lz4-java-1.11.2.jar * Apache HTTP Client - org.apache.httpcomponents-httpclient-4.5.14.jar - org.apache.httpcomponents-httpcore-4.4.16.jar diff --git a/pom.xml b/pom.xml index d5726190f96bc..100324d9b71e7 100644 --- a/pom.xml +++ b/pom.xml @@ -375,7 +375,7 @@ flexible messaging model and an intuitive client API. 1.11.0 2.15.1 2.1.10 - 1.11.1 + 1.11.2 3.0.2