{"schema":"vulnpedia.research/1","cve":"CVE-2026-106449","generated":"2026-10-26T13:52:32.101Z","references":[{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr","tags":["x_refsource_CONFIRM","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T19:46:28.569Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T19:46:28.569Z","url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"},{"source":"nvd","sourceId":"CVE-2026-106449","modified":"2026-10-07T17:16:47.877","url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"},{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"},{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"}]},{"url":"https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","tags":["x_refsource_MISC","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T19:46:28.569Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T19:46:28.569Z","url":"https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8"},{"source":"nvd","sourceId":"CVE-2026-106449","modified":"2026-10-07T17:16:47.877","url":"https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8"},{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","url":"https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8"},{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","url":"https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8"},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8"}]},{"url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","tags":["x_refsource_MISC","WEB","vendor-reference"],"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T19:46:28.569Z","origins":[{"source":"mitre","sourceId":"GitHub_M","modified":"2026-10-06T19:46:28.569Z","url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"},{"source":"nvd","sourceId":"CVE-2026-106449","modified":"2026-10-07T17:16:47.877","url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"},{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"},{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"}]},{"url":"https://osv.dev/vulnerability/GHSA-343h-94h5-c4wr","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","origins":[{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","url":"https://osv.dev/vulnerability/GHSA-343h-94h5-c4wr"},{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","url":"https://osv.dev/vulnerability/GHSA-343h-94h5-c4wr"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106449","tags":["ADVISORY","vendor-reference"],"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","origins":[{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106449"},{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106449"},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106449"}]},{"url":"https://github.com/yawkat/lz4-java","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","origins":[{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","url":"https://github.com/yawkat/lz4-java"},{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","url":"https://github.com/yawkat/lz4-java"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2026-106449","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://access.redhat.com/security/cve/CVE-2026-106449"}]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547101","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547101"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106449","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2026-106449"}]},{"source":"euvd","sourceId":"EUVD-2026-93862","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93862","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-93862","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-93862"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","url":"https://osv.dev/vulnerability/GHSA-343h-94h5-c4wr","ecosystem":"Maven","name":"at.yawk.lz4:lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4"}]}],"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.11.0","1.11.1","1.11.2","1.11.3","1.8.1","1.9.0"],"databaseSpecific":{"last_known_affected_version_range":"<= 1.11.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-343h-94h5-c4wr/GHSA-343h-94h5-c4wr.json"},"modified":"2026-10-07T20:45:07.306709237Z","origins":[{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","url":"https://osv.dev/vulnerability/GHSA-343h-94h5-c4wr"}]},{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","url":"https://osv.dev/vulnerability/GHSA-343h-94h5-c4wr","ecosystem":"Maven","name":"org.lz4:lz4-java","purl":"pkg:maven/org.lz4/lz4-java","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.1"}]}],"versions":["1.4","1.4.0","1.4.1","1.5.0","1.5.1","1.6.0","1.7.0","1.7.1","1.8.0","1.8.1"],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-343h-94h5-c4wr/GHSA-343h-94h5-c4wr.json"},"modified":"2026-10-07T20:45:07.306709237Z","origins":[{"source":"ghsa","sourceId":"GHSA-343h-94h5-c4wr","modified":"2026-10-07T20:45:07.306709237Z","url":"https://osv.dev/vulnerability/GHSA-343h-94h5-c4wr"}]}],"pocCandidates":[],"cataloguedPoc":[],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_build_of_apache_camel_for_spring_boot_4:lz4-java","product":"lz4-java as a component of Red Hat build of Apache Camel for Spring Boot 4","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:maven/org.lz4/lz4-java@1.8.0.redhat-00010","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_build_of_debezium_3:lz4-java","product":"lz4-java as a component of Red Hat build of Debezium 3","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:maven/org.lz4/lz4-java@1.8.0.redhat-00010","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_enterprise_linux_9:jmc","product":"jmc as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jmc","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_enterprise_linux_9:jmc.src","product":"jmc.src as a component of Red Hat Enterprise Linux 9","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:rpm/redhat/jmc?arch=src","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_fuse_7:lz4-java","product":"lz4-java as a component of Red Hat Fuse 7","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"no_fix_planned","details":"Out of support scope"}],"purl":"pkg:maven/org.lz4/lz4-java@1.8.0.redhat-00010","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_jboss_enterprise_application_platform_8:lz4-java","product":"lz4-java as a component of Red Hat JBoss Enterprise Application Platform 8","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:maven/org.lz4/lz4-java@1.8.0.redhat-00010","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_jboss_enterprise_application_platform_expansion_pack:lz4-java","product":"lz4-java as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:maven/org.lz4/lz4-java@1.8.0.redhat-00010","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-spark-operator-rhel9","product":"rhoai/odh-spark-operator-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-spark-operator-rhel9@sha256:837b9d7278cac5b40b2ddd989c05e2d07566bfd6ee4454a5a6add2779fdad887?repository_url=registry.redhat.io/rhoai/odh-spark-operator-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th-torch-cpu-py312-rhel9","product":"rhoai/odh-th-torch-cpu-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-th-torch-cpu-py312-rhel9@sha256:d265d1398bceb2d971d725e27e81c8def1213b2f0dc265a37707b2f4270317ca?repository_url=registry.redhat.io/rhoai/odh-th-torch-cpu-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th-torch-cuda-py312-rhel9","product":"rhoai/odh-th-torch-cuda-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-th-torch-cuda-py312-rhel9@sha256:efd7b3607b699092c68359d20ef0d0043114191a097637667c0d2cf78fbea702?repository_url=registry.redhat.io/rhoai/odh-th-torch-cuda-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch210-py312-rhel9","product":"rhoai/odh-th06-cpu-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-th06-cpu-torch210-py312-rhel9@sha256:cdd7d9f982c1f8a94dd4aad43e705274aae1bf0942e0442e60c3973f9c198f23?repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch210-py312-rhel9","product":"rhoai/odh-th06-cuda130-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-th06-cuda130-torch210-py312-rhel9@sha256:ea69ab01a3aaeba9b4db8abbace9014a3044e0f0f13fb7aaaef93acf72f50248?repository_url=registry.redhat.io/rhoai/odh-th06-cuda130-torch210-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]},{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json","productId":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-rocm64-torch291-py312-rhel9","product":"rhoai/odh-th06-rocm64-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","status":"known_affected","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."},{"category":"none_available","details":"Fix deferred"}],"purl":"pkg:oci/odh-th06-rocm64-torch291-py312-rhel9@sha256:b2a253f3dc063a8e1cee441640cce13fcf04918ce453be8f5d488301b1458a91?repository_url=registry.redhat.io/rhoai/odh-th06-rocm64-torch291-py312-rhel9","origins":[{"source":"redhat","sourceId":"CVE-2026-106449","modified":"2026-10-07T06:12:06+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json"}]}],"vendorCoverage":{"total":13,"shown":13,"omitted":0,"source":"redhat"}}