lz4_flex
Activity
- Latest release
- 2mo ago
- Total releases
- 43
- Cadence
- ~4 days
- Last 12 months
- 7
Details
- License
- MIT
- First release
- Oct 18, 2020
| Version | Released | |
|---|---|---|
0.14.0
unknown
|
0.14.0
unknown
Dependencies (9)
+ 1 more |
|
0.13.1
unknown
|
0.13.1
unknown
Dependencies (9)
+ 1 more |
|
0.12.2
unknown
|
0.12.2
unknown
Dependencies (9)
+ 1 more |
|
0.13.0
unknown
|
0.13.0
unknown
Dependencies (9)
+ 1 more |
|
0.11.6
unknown
|
0.11.6
unknown
Dependencies (9)
+ 1 more |
|
0.12.1
unknown
|
0.12.1
unknown
Dependencies (9)
+ 1 more |
|
0.12.0
unknown
yanked
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.12.0
unknown
yanked
Dependencies (9)
+ 1 more |
|
0.11.5
unknown
yanked
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.11.5
unknown
yanked
Dependencies (9)
+ 1 more |
|
0.11.4
unknown
yanked
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.11.4
unknown
yanked
Dependencies (9)
+ 1 more |
|
0.11.3
unknown
yanked
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.11.3
unknown
yanked
Dependencies (7)
|
|
0.11.2
unknown
yanked
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.11.2
unknown
yanked
Dependencies (7)
|
|
0.11.1
unknown
yanked
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.11.1
unknown
yanked
Dependencies (7)
|
|
0.11.0
unknown
yanked
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.11.0
unknown
yanked
Dependencies (7)
|
|
0.10.0
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.10.0
unknown
Dependencies (7)
|
|
0.9.5
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.9.5
unknown
Dependencies (7)
|
|
0.9.4
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.9.4
unknown
Dependencies (7)
|
|
0.9.3
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.9.3
unknown
Dependencies (7)
|
|
0.9.2
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.9.2
unknown
Dependencies (7)
|
|
0.9.1
unknown
yanked
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.9.1
unknown
yanked
Dependencies (7)
|
|
0.9.0
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.9.0
unknown
Dependencies (7)
|
|
0.8.2
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.8.2
unknown
Dependencies (7)
|
|
0.8.1
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.8.1
unknown
Dependencies (7)
|
|
0.8.0
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.8.0
unknown
Dependencies (7)
|
|
0.7.5
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.7.5
unknown
Dependencies (4)
|
|
0.7.4
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.7.4
unknown
Dependencies (4)
|
|
0.7.3
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.7.3
unknown
Dependencies (4)
|
|
0.7.2
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.7.2
unknown
Dependencies (4)
|
|
0.7.0
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.7.0
unknown
Dependencies (4)
|
|
0.6.1
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.6.1
unknown
Dependencies (5)
|
|
0.6.0
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.6.0
unknown
Dependencies (6)
|
|
0.5.1
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.5.1
unknown
Dependencies (6)
|
|
0.5.0
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.5.0
unknown
Dependencies (6)
|
|
0.4.3
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.4.3
unknown
Dependencies (6)
|
|
0.4.2
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.4.2
unknown
Dependencies (6)
|
|
0.4.1
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.4.1
unknown
Dependencies (6)
|
|
0.4.0
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.4.0
unknown
Dependencies (6)
|
|
0.3.6
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.3.6
unknown
Dependencies (6)
|
|
0.3.5
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.3.5
unknown
Dependencies (6)
|
|
0.3.4
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.3.4
unknown
Dependencies (6)
|
|
0.3.3
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.3.3
unknown
Dependencies (6)
|
|
0.3.2
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.3.2
unknown
Dependencies (6)
|
|
0.3.1
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.3.1
unknown
Dependencies (6)
|
|
0.3.0
unknown
1 CVE
CVE-2026-32829
RUSTSEC-2026-0041
GHSA-vvp9-7p8x-rfvv
Mar 17, 2026
Decompressing invalid data can leak information from uninitialized memory or reused output buffer
High
Network
Low
None
None
Decompressing invalid LZ4 data with the block API can leak data from uninitialized memory, or leak content from previous decompression operations when reusing an output buffer. The LZ4 block format defines a "match copy operation" which duplicates previously written
data or data from a user-supplied dict. The position of that data is defined by an offset.
Two scenarios are affected:
Only the block-based APIs are affected. All frame APIs are unaffected. The flaw was corrected in versions 0.11.6 and 0.12.1 by properly validating offset values during decompression. If upgrading is not possible, the issue can be mitigated by zeroing the output buffer before
each call to the affected functions and enabling the Fixed in
0.11.6
0.12.1
Updated Mar 17, 2026 · Source: OSV.dev |
0.3.0
unknown
Dependencies (6)
|