Skip to content
Fencer Vulns
high 7.3

CVE-2026-106451 json

yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

published 2026-10-06 33 d ago modified 2026-10-07 32 d ago also GHSA-mcr4-qmvw-px4g , EUVD-2026-93868

cvss
7.3
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.

Patch / fix

  • maven at.yawk.lz4:lz4-java 1.11.4

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-106451 updated cvss 7.0

org.lz4/lz4-java: lz4-java: Arbitrary code execution via insecure temporary file handling

  • Red Hat OpenShift Developer Tools and Services jenkins-2-plugins, ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9 Red Hat build of Apache Camel 4 for Quarkus 3 lz4-java Red Hat build of Apache Camel for Spring Boot 4 lz4-java, liblz4-java.so Red Hat build of Apicurio Registry 3 lz4-java Red Hat build of Debezium 3 lz4-java
    affected: workaround, no fix available “Fix deferred”
  • Red Hat build of Quarkus lz4-java
    affected: workaround, no fix available
  • Red Hat Enterprise Linux 8 lz4-java, lz4-java-javadoc Red Hat Enterprise Linux 9 jmc
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Fuse 7 lz4-java
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Hardened Images maven3.9 Red Hat JBoss Enterprise Application Platform 8 lz4-java, liblz4-java.so Red Hat JBoss Enterprise Application Platform Expansion Pack lz4-java, liblz4-java.so Red Hat OpenShift AI (RHOAI) rhoai/odh-spark-operator-rhel9, rhoai/odh-th-torch-cpu-py312-rhel9, rhoai/odh-th-torch-cuda-py312-rhel9, rhoai/odh-th06-cpu-torch210-py312-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, rhoai/odh-th06-rocm64-torch291-py312-rhel9, +2 more
    affected: workaround, no fix available “Fix deferred”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
32 d ago

Exploit prediction

0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 7.3 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 7.3 CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
maven at.yawk.lz4:lz4-java
<1.11.4
1.11.4
maven org.lz4:lz4-java
>=1.7.0, <=1.8.1
 no fix listed

Affected products

  • yawkat lz4-java

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
  • CWE-377 DEPRECATED: Insecure Temporary File

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.