8.2
Élevée
CVE-2026-32829 lz4_flex is a pure Rust implementation of LZ4 compression/decompression
Description
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Logging Subsystem for Red Hat OpenShift 6.2 1776894389 | premières → < 1776894389 | 1776894389 |
| Logging Subsystem for Red Hat OpenShift 6.4 1780052069 | premières → < 1780052069 | 1780052069 |
| Logging Subsystem for Red Hat OpenShift 6.5 1777574710 | premières → < 1777574710 | 1777574710 |
| Red Hat OpenShift AI 3.3 1778263962 | premières → < 1778263962 | 1778263962 |
| OpenShift Lightspeed | Versions non publiées | |
| Red Hat Ansible Automation Platform 2 | Versions non publiées | |
| Red Hat Enterprise Linux 10 | Versions non publiées | |
| Red Hat Enterprise Linux 9 | Versions non publiées | |
| Red Hat OpenShift AI (RHOAI) | Versions non publiées |
Afficher les 4 autres branches Masquer les 4 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| lz4_flex 0.12 | 0.12.0 → < 0.12.1 | 0.12.1 |
| lz4_flex 0.11 | premières → < 0.11.6 | 0.11.6 |
| Logging for Red Hat OpenShift 6.2 | Versions non publiées | |
| Logging for Red Hat OpenShift 6.4 1780052069 | premières → < 1780052069 | 1780052069 |
Références
- github.com github.com
- github.com github.com
- rustsec.org rustsec.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Logging Subsystem for Red Hat OpenShift 6.2
Les 14 CVE de Logging Subsystem for Red Hat OpenShift 6.2 →
CVE-2026-39821
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label
9.6
Critique
CVE-2026-33811
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a…
7.5
Élevée
CVE-2026-39820
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion…
7.5
Élevée
CVE-2026-42499
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322
7.5
Élevée