{ "@id": "urn:uuid:4bc08a79-3b14-48fc-8992-335c1f64c22e", "role": "Document Creator", "author": "https://tuxcare.com", "version": 5, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T09:02:00.202619+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1" } } ], "timestamp": "2026-11-04T09:02:00.202619+00:00", "status_notes": "Vulnerability CVE-2025-12183 does not affect version 1.8.1-tuxcare.1 of org.lz4:lz4-java. CVE-2025-12183 affects org.lz4:lz4-java 1.8.0 and earlier with out-of-bounds memory operations from untrusted compressed input. The vulnerability is fixed in version 1.8.1 by commit 8b4f4c0 (authored by yawkat/Jonas Konrad), which replaces unsafe fast decompressor implementations with LZ4JavaSafeFastDecompressor.INSTANCE that validates buffer boundaries. This fix was already present in the upstream 1.8.1 release when TuxCare onboarded the project (first TuxCare commit: 1400db9). The target repository at e2c2c5c contains the complete fix - all public factory methods (nativeInstance, unsafeInstance, safeInstance) now return safe decompressors by default. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.8.1; < 1.8.1), cve.org (>= 1.0.0, <= 1.8.0), Snyk (< 1.8.1).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-12183" }, "impact_statement": "CVE-2025-12183 affects org.lz4:lz4-java 1.8.0 and earlier with out-of-bounds memory operations from untrusted compressed input. The vulnerability is fixed in version 1.8.1 by commit 8b4f4c0 (authored by yawkat/Jonas Konrad), which replaces unsafe fast decompressor implementations with LZ4JavaSafeFastDecompressor.INSTANCE that validates buffer boundaries. This fix was already present in the upstream 1.8.1 release when TuxCare onboarded the project (first TuxCare commit: 1400db9). The target repository at e2c2c5c contains the complete fix - all public factory methods (nativeInstance, unsafeInstance, safeInstance) now return safe decompressors by default. The vulnerable code pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 1.8.1; < 1.8.1), cve.org (>= 1.0.0, <= 1.8.0), Snyk (< 1.8.1)." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-66566 is fixed in version 1.8.1-tuxcare.1 of org.lz4:lz4-java.", "vulnerability": { "name": "CVE-2025-66566" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1" } } ], "timestamp": "2026-10-07T20:44:00.113657+00:00", "status_notes": "Vulnerability CVE-2026-106449 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java.", "vulnerability": { "name": "CVE-2026-106449" }, "action_statement": "Vulnerability CVE-2026-106449 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1" } } ], "timestamp": "2026-10-07T20:44:00.113657+00:00", "status_notes": "Vulnerability CVE-2026-106450 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java.", "vulnerability": { "name": "CVE-2026-106450" }, "action_statement": "Vulnerability CVE-2026-106450 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1" } } ], "timestamp": "2026-10-07T20:44:00.113657+00:00", "status_notes": "Vulnerability CVE-2026-106451 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java.", "vulnerability": { "name": "CVE-2026-106451" }, "action_statement": "Vulnerability CVE-2026-106451 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1" } } ], "timestamp": "2026-10-07T16:28:01.660854+00:00", "status_notes": "Vulnerability CVE-2026-106452 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java.", "vulnerability": { "name": "CVE-2026-106452" }, "action_statement": "Vulnerability CVE-2026-106452 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1" } } ], "timestamp": "2026-10-07T16:28:01.660854+00:00", "status_notes": "Vulnerability CVE-2026-106453 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java.", "vulnerability": { "name": "CVE-2026-106453" }, "action_statement": "Vulnerability CVE-2026-106453 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1", "identifiers": { "purl": "pkg:maven/org.lz4/lz4-java@1.8.1-tuxcare.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59949 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java.", "vulnerability": { "name": "CVE-2026-59949" }, "action_statement": "Vulnerability CVE-2026-59949 affects version 1.8.1-tuxcare.1 of org.lz4:lz4-java." } ] }