DEBIAN-CVE-2026-32829
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.
DEBIAN-CVE-2026-32829
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-32829
rust-lz4-flex
Source reference: /affected/0/package/name
- Affected versions
- 0.11.3-1
Source reference:
/affected/0/versions0.11.3-2Source reference:
/affected/0/versions0.13.0-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
rust-lz4-flex
Source reference: /affected/1/package/name
- Affected versions
- 0.11.3-1
Source reference:
/affected/1/versions0.11.3-2Source reference:
/affected/1/versions - Fixed versions
- 0.13.0-1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "rust-lz4-flex",
"purl": "pkg:deb/debian/rust-lz4-flex?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"0.11.3-1",
"0.11.3-2",
"0.13.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32829.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.13.0-1"
}
]
}
],
"package": {
"name": "rust-lz4-flex",
"purl": "pkg:deb/debian/rust-lz4-flex?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"0.11.3-1",
"0.11.3-2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32829.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56777 · Revision 1
- Added to Heist Feed
- Publisher date