Skip to content
fr Sign in
8.2 High

CVE-2026-32829 lz4_flex is a pure Rust implementation of LZ4 compression/decompression

Description

lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.

Affected products and versions

Product Affected versions Fixed in
Logging Subsystem for Red Hat OpenShift 6.2 1776894389 earliest → < 1776894389 1776894389
Logging Subsystem for Red Hat OpenShift 6.4 1780052069 earliest → < 1780052069 1780052069
Logging Subsystem for Red Hat OpenShift 6.5 1777574710 earliest → < 1777574710 1777574710
Red Hat OpenShift AI 3.3 1778263962 earliest → < 1778263962 1778263962
OpenShift Lightspeed Versions not published
Red Hat Ansible Automation Platform 2 Versions not published
Red Hat Enterprise Linux 10 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat OpenShift AI (RHOAI) Versions not published
Show the 4 other branches
Product Affected versions Fixed in
lz4_flex 0.12 0.12.0 → < 0.12.1 0.12.1
lz4_flex 0.11 earliest → < 0.11.6 0.11.6
Logging for Red Hat OpenShift 6.2 Versions not published
Logging for Red Hat OpenShift 6.4 1780052069 earliest → < 1780052069 1780052069

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Logging Subsystem for Red Hat OpenShift 6.2

The 14 CVEs of Logging Subsystem for Red Hat OpenShift 6.2 →
CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label 9.6 Critical CVE-2026-33811 When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a… 7.5 High CVE-2026-39820 Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion… 7.5 High CVE-2026-42499 Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322 7.5 High
Track this CVE