[Git][security-tracker-team/security-tracker][master] Add new lz4-java CVEs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5e557147 by Salvatore Bonaccorso at 2026-10-07T10:48:45+02:00
Add new lz4-java CVEs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -317,15 +317,25 @@ CVE-2026-106455 (Backstage is an open framework for building developer portals.
 CVE-2026-106454 (Twisted is an event-based framework for internet applications, support ...)
 	TODO: check
 CVE-2026-106453 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ ...)
-	TODO: check
+	- lz4-java 1.11.2+ds1-1
+	NOTE: https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g
+	NOTE: Fixed by: https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a (v1.11.2)
 CVE-2026-106452 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, ne ...)
-	TODO: check
+	- lz4-java 1.11.2+ds1-1
+	NOTE: https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464
+	NOTE: Fixed by: https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634 (v1.11.2)
 CVE-2026-106451 (yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1. ...)
-	TODO: check
+	- lz4-java <unfixed>
+	NOTE: https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g
+	NOTE: Fixed by: https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3 (v1.11.4)
 CVE-2026-106450 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, ne ...)
-	TODO: check
+	- lz4-java <unfixed>
+	NOTE: https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv
+	NOTE: Fixed by: https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283 (v1.11.4)
 CVE-2026-106449 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, ne ...)
-	TODO: check
+	- lz4-java <unfixed>
+	NOTE: https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr
+	NOTE: Fixed by: https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8 (v1.11.4)
 CVE-2026-106448 (StableLib is a stable library of useful TypeScript and JavaScript code ...)
 	TODO: check
 CVE-2026-106447 (StableLib is a stable library of useful TypeScript and JavaScript code ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e557147f81da012cda1310eef2b33a70cbc884b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e557147f81da012cda1310eef2b33a70cbc884b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/ef222d1f/attachment.htm>