lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-201.
Summary
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PSeitz | lz4_flex | before 0.11.6; 0.12.0 to before 0.12.1 | 0.11.6, 0.12.1 | Patch available | CNA |
| — | lz4_flex (crates.io) | before 0.11.6 | 0.11.6 | Patch available | GHSA-vvp9-7p8x-rfvv |
| — | lz4_flex (crates.io) | 0.12.0 to before 0.12.1 | 0.12.1 | Patch available | GHSA-vvp9-7p8x-rfvv |
- lz4_flex VendorPSeitz Affected before 0.11.6; 0.12.0 to before 0.12.1 Fixed in 0.11.6, 0.12.1 Patch available CNA
- lz4_flex (crates.io) Vendor— Affected before 0.11.6 Fixed in 0.11.6 Patch available GHSA-vvp9-7p8x-rfvv
- lz4_flex (crates.io) Vendor— Affected 0.12.0 to before 0.12.1 Fixed in 0.12.1 Patch available GHSA-vvp9-7p8x-rfvv
Remediation
- Fix · CNA lz4_flex (PSeitz) Fixed in 0.11.6, 0.12.1
- Fix · GHSA-vvp9-7p8x-rfvv lz4_flex (crates.io) Fixed in 0.11.6 Advisory →
- Fix · GHSA-vvp9-7p8x-rfvv lz4_flex (crates.io) Fixed in 0.12.1 Advisory →
Red Hat 4 advisories
- RHSA-2026:22862 Released 2026-06-03 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.4.5
- Logging Subsystem for Red Hat OpenShift 6.4 registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/vector-rhel9
- RHSA-2026:19712 Released 2026-05-20 · Red Hat rating CriticalRHOAI 3.3.3 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
- RHSA-2026:16354 Released 2026-05-12 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.5.1
- Logging Subsystem for Red Hat OpenShift 6.5 registry.redhat.io/openshift-logging/vector-rhel9
Show 1 more Red Hat advisories
- RHSA-2026:11800 Released 2026-04-29 · Red Hat rating ImportantLogging for Red Hat OpenShift - 6.2.10
- Logging Subsystem for Red Hat OpenShift 6.2 registry.redhat.io/openshift-logging/eventrouter-rhel9, registry.redhat.io/openshift-logging/vector-rhel9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32829
- 2026-10-03 Alias added: GHSA-vvp9-7p8x-rfvv
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-11-06 EPSS moved to the 50th–90th percentile
References
Advisory 3
Sources
- CVE-2026-32829 · CVE Program
- CVE-2026-32829 · NVD
- FIRST EPSS
- GHSA-vvp9-7p8x-rfvv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-32829 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences