CVE-2026-106451

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-106451
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106451.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-106451
Aliases
Downstream
CGA (385)
CLEANSTART (7)
DEBIAN (1)
ECHO (1)
MINI (38)
ROOT (1)
UBUNTU (1)
Published
2026-10-06T19:50:41Z
Modified
2026-10-21T09:38:07Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
Details

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-367",
        "CWE-377"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106451.json"
}
References

Affected packages

Git / github.com/yawkat/lz4-java

Affected ranges

Type
GIT
Repo
https://github.com/yawkat/lz4-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4af910bc99c2f021f0cd56f6ca7f7600f4dda4a0
Fixed
7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.11.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.11.4",
            "range":  [
                {
                    "fixed":  "4af910bc99c2f021f0cd56f6ca7f7600f4dda4a0"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.0.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
1.8.0
v1.*
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106451.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "287088744076101561089987277734726586827",
            "length":  125
        },
        "id":  "CVE-2026-106451-002e4f76",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3",
        "target":  {
            "file":  "src/java/net/jpountz/util/Native.java",
            "function":  "accept"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "120901721585003660232217243433831864094",
                "21712996789340016328126203079016646001",
                "25473077557002869923624234269887303300",
                "62475241902529164834393452404932245231",
                "227384246562376937438976399619737953159",
                "208664858325895609181399240625099227886",
                "25138500594734870830997788671479682860",
                "320567468287002545320622577680235745807",
                "314654137839177143501896311370165115541",
                "42664398240750111717883718681722628108",
                "300927539618275445716116077319246901866",
                "211943747635801197732844048374690030634",
                "142320486393207605898405934667622441411",
                "322506630011422885236028102073494323195",
                "109433495036356898702573374832591725065",
                "273347030859545362639917355000242246872",
                "163185108936385451507512460175748007400",
                "205070602133759072376564461348611667933",
                "154677288789998535801537687073198758976",
                "100595864089429936516965501111676982658",
                "4230180131956711401849689814922517239",
                "106344305409420623079790145987301926013",
                "61408008993490099113339370709134643061",
                "114137998578556242993849384874344066302",
                "260903685725362348146611014497080944750",
                "219879730991681877941294735456340847519",
                "79274897104313645229756091171566171185",
                "148581888027939879675262654694345763455",
                "50636697621526209881254645593123379030",
                "276694539083499025644998959399331651637",
                "290335205016574670831951470126627157192",
                "260620815850556782299356137917247133604",
                "293551931933590866045944342229154877041",
                "87220921517007679870536274177076500920",
                "52296283295427036648168904494333463005",
                "124240915486926439903837452387208737532",
                "247392943747542213772632303340025600559",
                "325305755874604266913669105593481083046",
                "24501234535006697431234705038672472381",
                "97987993318856849378273210648378926450",
                "331893505669638164662844064563536767777"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-106451-10e5124c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3",
        "target":  {
            "file":  "src/test/net/jpountz/lz4/LZ4Test.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "313011943050182049463074772973942323990",
            "length":  124
        },
        "id":  "CVE-2026-106451-12493a4e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3",
        "target":  {
            "file":  "src/test/net/jpountz/lz4/LZ4Test.java",
            "function":  "accept"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "132087483230830617327672350341105040487",
            "length":  126
        },
        "id":  "CVE-2026-106451-1435005b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3",
        "target":  {
            "file":  "src/test/net/jpountz/lz4/LZ4Test.java",
            "function":  "accept"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "221614571560477583567656466894622851769",
                "124808930974112017734919480770755286103",
                "297793401976604358955195445932880584657",
                "330719858037120042533006096643356459071",
                "53875471267811863823666297284320750872",
                "160521809625033348973586608509111522446",
                "38284091031970947917287551499458496304",
                "334468067420058977545307072411762964227",
                "213640472424273879514390041972175378028",
                "20246845708117442788854856998194553615",
                "274280036136218012811588012471636841588",
                "154677288789998535801537687073198758976",
                "100595864089429936516965501111676982658",
                "274562682403534415823370530244787051866",
                "22055569514580338784787423138761529487",
                "179502299417367021531819133188498188345",
                "294616860795031284951633549229125218902",
                "66459627207314063533992753249982914810",
                "89013036040375482973847851166874736283",
                "3657459170923037519157362910043105314",
                "70998658741015903464641561061351350152",
                "276062278795901299497884943216848429010",
                "199409170181630947842370518607105790078",
                "117903822473590838646949334448949643416",
                "270765047907820898618609058292785592114",
                "21773527645596435911697202433637795016",
                "38000368715148620082918254437284258699",
                "196337175106372597637010314426105022941",
                "201183755291689487439743500123085222335",
                "96103908349045077250491745437136605204",
                "80047418054106922043691325042029004915",
                "262478609590690256705602424344244788647",
                "128780141424566017499935643543916608754",
                "183586597064087837283688503726720402924",
                "28198055828004680740910719251887833095",
                "7685402577225522447940354419329763710",
                "315219707804011452436219005541383370777",
                "196819008729897004248661013218235919996",
                "312291034918468127848375425329689670558",
                "244383018117280147618284879914063850925",
                "296700017983925604372862166176955760756",
                "85803129837098032292091836138515185911",
                "101644282966211165887378866428708777734"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-106451-341bd4f3",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3",
        "target":  {
            "file":  "src/java/net/jpountz/util/Native.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "214388248717931299923900274857980516335",
                "65683750676527707633078656054170255344",
                "118287103178809004985414128698616388518",
                "300637533127697537612035724601996989858",
                "266104950906479238541857316988367999351",
                "134728242984367791732063153507024217733",
                "42467283072344628588104348871426341262",
                "120304495577461616964057978192822068584",
                "241948005302004834692069803815921267754",
                "300772486054080233650511326870296722448",
                "199868925319664771762581168079999457280",
                "199852464834928763731943148423675137228",
                "5780372513503982885265799084234661786",
                "185404016909992595827221147264550945351",
                "26652769941461710058292728882523053930",
                "13075325095172813375000686650282311601",
                "269691371974919895669012905319974831748",
                "68119049062416810164251849865742483758",
                "118762952372007463797917670866819281951",
                "269126750384551754583012292750271610628",
                "173611378178514036441531353351102857178"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-106451-51af3d82",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/4af910bc99c2f021f0cd56f6ca7f7600f4dda4a0",
        "target":  {
            "file":  "src/test/net/jpountz/lz4/LZ4BlockStreamingTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "3455026604948020737923280569870426578",
            "length":  693
        },
        "id":  "CVE-2026-106451-795c07a1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3",
        "target":  {
            "file":  "src/java/net/jpountz/util/Native.java",
            "function":  "cleanupOldTempLibs"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "286031121629275242423407948560214043509",
            "length":  1090
        },
        "id":  "CVE-2026-106451-b0e1f96c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3",
        "target":  {
            "file":  "src/test/net/jpountz/lz4/LZ4Test.java",
            "function":  "testLockFileOfTemporaryNativeLibrary"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "211204462489201893330757331476224378062",
            "length":  1639
        },
        "id":  "CVE-2026-106451-b5712e6a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3",
        "target":  {
            "file":  "src/java/net/jpountz/util/Native.java",
            "function":  "load"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "20082239809390668882048052815584052754",
            "length":  678
        },
        "id":  "CVE-2026-106451-e30894f2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/4af910bc99c2f021f0cd56f6ca7f7600f4dda4a0",
        "target":  {
            "file":  "src/test/net/jpountz/lz4/LZ4BlockStreamingTest.java",
            "function":  "testAvailableAfterEmptyBlock"
        }
    }
]
vanir_signatures_modified 
"2026-10-21T09:38:07Z"