PSeitz lz4_flex up to 0.11.5/0.12.0 insertion of sensitive information into sent data

Summaryinfo

A vulnerability, which was classified as problematic, was found in PSeitz lz4_flex up to 0.11.5/0.12.0. Affected by this issue is the function lz4_flex. Such manipulation leads to insertion of sensitive information into sent data. This vulnerability is documented as CVE-2026-32829. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in PSeitz lz4_flex up to 0.11.5/0.12.0. It has been rated as problematic. Affected by this issue is the function lz4_flex. The manipulation with an unknown input leads to a insertion of sensitive information into sent data vulnerability. Using CWE to declare the problem leads to CWE-201. The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor. Impacted is confidentiality. CVE summarizes:

lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-32829 since 03/16/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 0.11.6 or 0.12.1 eliminates this vulnerability. Applying the patch 055502ee5d297ecd6bf448ac91c055c7f6df9b6d is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• PSeitz

Name

• lz4_flex

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.11.0
• 0.11.1
• 0.11.2
• 0.11.3
• 0.11.4
• 0.11.5
• 0.12.0

License

• open-source

Website

• Product: https://github.com/PSeitz/lz4_flex/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion