PSeitz lz4_flex vulnerabilities

Latest PSeitz lz4_flex CVEs

Newest publication first

1. CVE-2026-32829 lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer

   Published 2026-03-20

   High·CVSS 8.2 EPSS 0.63%

   lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly vali...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.