lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| logging | 6.2 | — | |
| logging | 6.4 | — | |
| logging | 6.5 | — | |
| openshift ai | 3.3 | — | |
| PSeitz | lz4_flex | < 0.11.6, >= 0.12.0, < 0.12.1 | |
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.2 | all versions | |
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.4 | all versions | |
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.5 | all versions | |
| Red Hat | OpenShift Lightspeed | all versions | |
| Red Hat | Red Hat Ansible Automation Platform 2 | all versions | |
| Red Hat | Red Hat Enterprise Linux 10 | — | |
| Red Hat | Red Hat Enterprise Linux 9 | — | |
| Red Hat | Red Hat OpenShift AI 3.3 | all versions | |
| Red Hat | Red Hat OpenShift AI (RHOAI) | — |
cpe:2.3:a:pseitz:lz4_flex:*:*:*:*:*:rust:*:* < 0.11.6cpe:2.3:a:pseitz:lz4_flex:0.12.0:*:*:*:*:rust:*:*Two free tools, one defence: the Sensor catches whoever probes your server; Shield stops known attackers before they reach your site.
Install it and your daily API quota goes to 30,000 lookups — nothing to apply for.