RUSTSEC-2026-0041Published

lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

cve-program · CVE-2026-32829

Published

lz4_flex

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "PSeitz",
                    "product": "lz4_flex",
                    "versions": [
                        {
                            "version": "< 0.11.6",
                            "status": "affected"
                        },
                        {
                            "version": ">= 0.12.0, < 0.12.1",
                            "status": "affected"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON

euvd · EUVD-2026-13426

Published

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Mar 20, 2026, 12:49:12 AM

dateUpdated: Sep 17, 2026, 12:04:33 PM

5 related source bulletins · separate from aliases

RHSA-2026:11800: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.2.10

CVE-2026-25679 · CVE-2026-27137 · CVE-2026-32829

RHSA-2026:22862: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.4.5

CVE-2026-25679 · CVE-2026-27137 · CVE-2026-31812 · CVE-2026-32280 · CVE-2026-32281 · CVE-2026-32282 · CVE-2026-32829 · CVE-2026-33810

RHSA-2026:16354: Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.5.1

CVE-2026-32829

WID-SEC-W-2026-1504: Logging Subsystem for Red Hat OpenShift: Schwachstelle ermöglicht Offenlegung von Informationen

CVE-2026-32829

RHSA-2026:19712: Red Hat Security Advisory: RHOAI 3.3.3 - Red Hat OpenShift AI

CVE-2025-6242 · CVE-2025-12816 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-59057 · CVE-2025-61726 · CVE-2025-61729 · CVE-2025-62164 · CVE-2025-62718 · CVE-2025-64756 · CVE-2025-66031 · CVE-2025-66418 · CVE-2025-66448 · CVE-2025-66471 · CVE-2025-69223 · CVE-2025-69873 · CVE-2026-0846 · CVE-2026-0847 · CVE-2026-4800 · CVE-2026-21441 · CVE-2026-21884 · CVE-2026-22029 · CVE-2026-22778 · CVE-2026-23490 · CVE-2026-23745 · CVE-2026-24049 · CVE-2026-24486 · CVE-2026-24779 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-27893 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29074 · CVE-2026-30922 · CVE-2026-31812 · CVE-2026-32597 · CVE-2026-32829 · CVE-2026-32981 · CVE-2026-33186 · CVE-2026-33231 · CVE-2026-33236 · CVE-2026-34986 · CVE-2026-40175 · CVE-2026-40192 · CVE-2026-40895

No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.

Original source record · Cite this exact observation · Complete original publisher JSON

nvd · CVE-2026-32829

Published

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Modified

Weakness classifications: CWE-201 · CWE-823

Original publisher date fields

published: 2026-03-20T01:15:56.277

lastModified: 2026-09-17T12:17:49.007

2 source CPE criteria · context only

cpe:2.3:a:pseitz:lz4_flex:*:*:*:*:*:rust:*:*
cpe:2.3:a:pseitz:lz4_flex:0.12.0:*:*:*:*:rust:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Original source record · Cite this exact observation · Complete original publisher JSON

osv · GHSA-vvp9-7p8x-rfvv

Published

lz4_flex

crates.io

SEMVER · introduced 0 → fixed 0.11.6

lz4_flex

crates.io

SEMVER · introduced 0.12.0 → fixed 0.12.1

Original source record · Cite this exact observation · Complete original publisher JSON

osv · RUSTSEC-2026-0041

Published

lz4_flex

crates.io

SEMVER · introduced 0.0.0-0 → fixed 0.11.6 → introduced 0.12.0 → fixed 0.12.1

Original source record · Cite this exact observation · Complete original publisher JSON