Vulnerability advisory: CVE-2026-106449/51, GHSA-qm45-99xc-r7wv (OOM/NPE/Integer Overflow)

Vulnerability Overview Vulnerability ID: GHSA-qm45-99xc-r7wv, CVE-2026-106449, CVE-2026-106451 Description: Security fixes, including patches for GHSA-qm45-99xc-r7wv, CVE-2026-106449, and CVE-2026-106451, as well as general bug fixes identified by AI. Impact Scope Affected Versions: v1.11.4 Specific Impacts: - Update action to v10.2.0 - Update dependency to v2.9.2 - Update digest to 953926a - Fix NPE in on skippable-only streams - Fix OOM in - Fix in - Reject truncated block headers in - Do not restore Maven cache in the release workflow - Read skippable frame size as unsigned in - Run test workflow only on push to main - Document CPU cost of high HC compression levels - Fix int overflow in streaming XXHash update buffering check - Document in scripts - Make docs manual-dispatch deploy branch explicit - Switch Maven wrapper to script-only and use strict checksums in CI - Validate SHA-256 of lz4 CLI downloaded in Windows release job - Document validation of version input and tag names before interpolating them - Test safe decompressors with destination offsets and buffer kinds - Document that returns only 28 bits - Declare explicit permissions in workflows - Publish to Central only from v tags - Test darwin/aarch64 native library before publishing - Fix negative after an empty block - Delete clinures - Rewrite README, add contributing guide, Scorecard, and coverage - Fix test compilation on main: remove duplicate Remediation Remediation Measures: - Update relevant dependencies and actions to their latest versions - Fix NPE, OOM, , and other errors - Reject truncated block headers - Do not restore Maven cache - Read skippable frame size as unsigned - Run test workflow only on push to main - Document CPU cost, int overflow, requires-python, etc. - Make docs manual-dispatch deploy branch explicit - Switch Maven wrapper to script-only and use strict checksums in CI - Validate SHA-256 of lz4 CLI downloaded in Windows release job - Document validation of version input and tag names before interpolating them - Test safe decompressors with destination offsets and buffer kinds - Document that returns only 28 bits - Declare explicit permissions in workflows - Publish to Central only from v tags - Test darwin/aarch64 native library before publishing - Fix negative after an empty block - Delete clinures - Rewrite README, add contributing guide, Scorecard, and coverage - Fix test compilation on main: remove duplicate POC Code or Exploit Code POC code or exploit code is not included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Vulnerability advisory: CVE-2026-106449/51, GHSA-qm45-99xc-r7wv (OOM/NPE/Integer Overflow)

More from this source