CVE-2026-32829

EUVD-2026-13426

20.03.2026, 01:15

lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0,  decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 45.82%

Affected Products (NVD)

Vendor	Product	Version
pseitz	lz4_flex	𝑥 < 0.11.6
pseitz	lz4_flex	0.12.0

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Red Hat	Logging Subsystem for Red Hat OpenShift 6.2	1776894389 ≤ 𝑥 < *	ADP
Red Hat	Logging Subsystem for Red Hat OpenShift 6.4	1780052069 ≤ 𝑥 < *	ADP
Red Hat	Logging Subsystem for Red Hat OpenShift 6.5	1777574710 ≤ 𝑥 < *	ADP
Red Hat	Red Hat OpenShift AI 3.3	1778263962 ≤ 𝑥 < *	ADP