lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-32829 · CVE overview and exploitation status

EUVD-2026-13426

GHSA-vvp9-7p8x-rfvv

RUSTSEC-2026-0041

cve-program · CVE-2026-32829

• https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv
• https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d
• https://rustsec.org/advisories/RUSTSEC-2026-0041.html

euvd · EUVD-2026-13426

• https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv
• https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d
• https://rustsec.org/advisories/RUSTSEC-2026-0041.html

nvd · CVE-2026-32829

• https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d
• https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv
• https://rustsec.org/advisories/RUSTSEC-2026-0041.html
• https://access.redhat.com/errata/RHSA-2026:11800
• https://access.redhat.com/errata/RHSA-2026:16354
• https://access.redhat.com/errata/RHSA-2026:19712
• https://access.redhat.com/errata/RHSA-2026:22862
• https://access.redhat.com/security/cve/CVE-2026-32829
• https://bugzilla.redhat.com/show_bug.cgi?id=2448271
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32829.json

osv · GHSA-vvp9-7p8x-rfvv

• https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv
• https://nvd.nist.gov/vuln/detail/CVE-2026-32829
• https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d
• https://github.com/PSeitz/lz4_flex
• https://rustsec.org/advisories/RUSTSEC-2026-0041.html

osv · RUSTSEC-2026-0041

• https://crates.io/crates/lz4_flex
• https://rustsec.org/advisories/RUSTSEC-2026-0041.html

No related changes are available here.