JLSEC-2026-532

See a problem?
Please try reporting it to the source first.

Source

https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-532.md

Import Source

https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-532.json

JSON Data

https://api.osv.dev/v1/vulns/JLSEC-2026-532

Upstream

CVE-2021-3520

Published

2026-05-26T19:04:01.666Z

Modified

2026-05-26T19:15:03.567831022Z

Summary

[none]

Details

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Database specific

{
    "sources": [
        {
            "published": "2021-06-02T13:15:13.170Z",
            "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-3520",
            "modified": "2024-11-21T06:21:44.987Z",
            "id": "CVE-2021-3520",
            "database_specific": {
                "status": "Modified"
            },
            "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3520",
            "imported": "2026-05-24T16:38:40.362Z"
        }
    ],
    "license": "CC-BY-4.0"
}

References

Affected packages

Julia / Lz4_jll

Package

Name: Lz4_jll
Purl: pkg:julia/Lz4_jll?uuid=5ced341a-0733-55b8-9ab6-a4889d929147

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.9.4+0

Database specific

source

"https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-532.json"