CVE-2026-32829

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32829", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-16T17:35:36.698Z", "datePublished": "2026-03-20T00:49:12.893Z", "dateUpdated": "2026-09-17T12:04:33.082Z"}, "containers": {"cna": {"title": "lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer", "problemTypes": [{"descriptions": [{"cweId": "CWE-201", "lang": "en", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-823", "lang": "en", "description": "CWE-823: Use of Out-of-range Pointer Offset", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv"}, {"name": "https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d", "tags": ["x_refsource_MISC"], "url": "https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d"}, {"name": "https://rustsec.org/advisories/RUSTSEC-2026-0041.html", "tags": ["x_refsource_MISC"], "url": "https://rustsec.org/advisories/RUSTSEC-2026-0041.html"}], "affected": [{"vendor": "PSeitz", "product": "lz4_flex", "versions": [{"version": "< 0.11.6", "status": "affected"}, {"version": ">= 0.12.0, < 0.12.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T00:49:12.893Z"}, "descriptions": [{"lang": "en", "value": "lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 \"match copy operations,\" allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1."}], "source": {"advisory": "GHSA-vvp9-7p8x-rfvv", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-21T03:02:22.812939Z", "id": "CVE-2026-32829", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-21T03:03:09.928Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:logging:6.2::el9"], "defaultStatus": "affected", "packageName": "openshift-logging/vector-rhel9", "product": "Logging Subsystem for Red Hat OpenShift 6.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1776894389", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:logging:6.4::el9"], "defaultStatus": "affected", "packageName": "openshift-logging/vector-rhel9", "product": "Logging Subsystem for Red Hat OpenShift 6.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780052069", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:logging:6.5::el9"], "defaultStatus": "affected", "packageName": "openshift-logging/vector-rhel9", "product": "Logging Subsystem for Red Hat OpenShift 6.5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1777574710", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-llm-d-inference-scheduler-rhel9", "product": "Red Hat OpenShift AI 3.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1778263962", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_lightspeed"], "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-service-api-rhel9", "product": "OpenShift Lightspeed", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "affected", "packageName": "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "rust", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "rust", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-model-registry-job-async-upload-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "datePublic": "2026-03-16T20:48:08.000Z", "descriptions": [{"lang": "en", "value": "lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 \"match copy operations,\" allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-823", "description": "Use of Out-of-range Pointer Offset", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-32829"}, {"name": "RHBZ#2448271", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448271"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32829.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:22862"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:16354"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:11800"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:19712"}], "solutions": [{"lang": "en", "value": "RHSA-2026:22862: Logging Subsystem for Red Hat OpenShift 6.4"}, {"lang": "en", "value": "RHSA-2026:16354: Logging Subsystem for Red Hat OpenShift 6.5"}, {"lang": "en", "value": "RHSA-2026:11800: Logging for Red Hat OpenShift 6.2"}, {"lang": "en", "value": "RHSA-2026:19712: Red Hat OpenShift AI 3.3"}], "timeline": [{"lang": "en", "time": "2026-03-16T22:05:38.553Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-16T20:48:08.000Z", "value": "Made public."}], "title": "lz4_flex: lz4_flex's decompression can leak information from uninitialized memory or reused output buffer", "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-17T12:04:33.082Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "lz4_flex: lz4_flex's decompression can leak information from uninitialized memory or reused output buffer", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"cpes": ["cpe:/a:redhat:logging:6.2::el9"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift 6.2", "versions": [{"status": "unaffected", "version": "1776894389", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-logging/vector-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:logging:6.4::el9"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift 6.4", "versions": [{"status": "unaffected", "version": "1780052069", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-logging/vector-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:logging:6.5::el9"], "vendor": "Red Hat", "product": "Logging Subsystem for Red Hat OpenShift 6.5", "versions": [{"status": "unaffected", "version": "1777574710", "lessThan": "*", "versionType": "rpm"}], "packageName": "openshift-logging/vector-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI 3.3", "versions": [{"status": "unaffected", "version": "1778263962", "lessThan": "*", "versionType": "rpm"}], "packageName": "rhoai/odh-llm-d-inference-scheduler-rhel9", "collectionURL": "https://catalog.redhat.com/software/containers/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift_lightspeed"], "vendor": "Red Hat", "product": "OpenShift Lightspeed", "packageName": "openshift-lightspeed/lightspeed-service-api-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "vendor": "Red Hat", "product": "Red Hat Ansible Automation Platform 2", "packageName": "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "rust", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "rust", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:openshift_ai"], "vendor": "Red Hat", "product": "Red Hat OpenShift AI (RHOAI)", "packageName": "rhoai/odh-model-registry-job-async-upload-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-16T22:05:38.553Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-03-16T20:48:08.000Z", "value": "Made public."}], "solutions": [{"lang": "en", "value": "RHSA-2026:11800: Logging Subsystem for Red Hat OpenShift 6.2"}, {"lang": "en", "value": "RHSA-2026:22862: Logging Subsystem for Red Hat OpenShift 6.4"}, {"lang": "en", "value": "RHSA-2026:16354: Logging Subsystem for Red Hat OpenShift 6.5"}, {"lang": "en", "value": "RHSA-2026:19712: Red Hat OpenShift AI 3.3"}], "x_adpType": "supplier", "datePublic": "2026-03-16T20:48:08.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-32829", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448271", "name": "RHBZ#2448271", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32829.json", "tags": ["x_sadp-csaf-vex"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:11800", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:22862", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:16354", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/errata/RHSA-2026:19712", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}], "x_generator": {"engine": "sadp-cli 1.0.0"}, "descriptions": [{"lang": "en", "value": "lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 \"match copy operations,\" allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-823", "description": "Use of Out-of-range Pointer Offset"}]}], "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-09-04T12:04:42.204Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32829", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-21T03:02:22.812939Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-21T03:03:04.108Z"}}], "cna": {"title": "lz4_flex: Decompression can leak information from uninitialized memory or reused output buffer", "source": {"advisory": "GHSA-vvp9-7p8x-rfvv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "PSeitz", "product": "lz4_flex", "versions": [{"status": "affected", "version": "< 0.11.6"}, {"status": "affected", "version": ">= 0.12.0, < 0.12.1"}]}], "references": [{"url": "https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv", "name": "https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d", "name": "https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d", "tags": ["x_refsource_MISC"]}, {"url": "https://rustsec.org/advisories/RUSTSEC-2026-0041.html", "name": "https://rustsec.org/advisories/RUSTSEC-2026-0041.html", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 \"match copy operations,\" allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-201", "description": "CWE-201: Insertion of Sensitive Information Into Sent Data"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-823", "description": "CWE-823: Use of Out-of-range Pointer Offset"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T00:49:12.893Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32829", "state": "PUBLISHED", "dateUpdated": "2026-09-04T12:04:42.204Z", "dateReserved": "2026-03-16T17:35:36.698Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T00:49:12.893Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "lz4_flex", "vendor": "PSeitz", "versions": [{"status": "affected", "version": "< 0.11.6"}, {"status": "affected", "version": ">= 0.12.0, < 0.12.1"}]}], "source": "security-advisories@github.com"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:logging:6.2::el9"], "defaultStatus": "affected", "packageName": "openshift-logging/vector-rhel9", "product": "Logging Subsystem for Red Hat OpenShift 6.2", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1776894389", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:logging:6.4::el9"], "defaultStatus": "affected", "packageName": "openshift-logging/vector-rhel9", "product": "Logging Subsystem for Red Hat OpenShift 6.4", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1780052069", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:logging:6.5::el9"], "defaultStatus": "affected", "packageName": "openshift-logging/vector-rhel9", "product": "Logging Subsystem for Red Hat OpenShift 6.5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1777574710", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:openshift_ai:3.3::el9"], "defaultStatus": "affected", "packageName": "rhoai/odh-llm-d-inference-scheduler-rhel9", "product": "Red Hat OpenShift AI 3.3", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1778263962", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_lightspeed"], "defaultStatus": "affected", "packageName": "openshift-lightspeed/lightspeed-service-api-rhel9", "product": "OpenShift Lightspeed", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:ansible_automation_platform:2"], "defaultStatus": "affected", "packageName": "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "product": "Red Hat Ansible Automation Platform 2", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10"], "defaultStatus": "unaffected", "packageName": "rust", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "unaffected", "packageName": "rust", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:openshift_ai"], "defaultStatus": "unaffected", "packageName": "rhoai/odh-model-registry-job-async-upload-rhel9", "product": "Red Hat OpenShift AI (RHOAI)", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pseitz:lz4_flex:*:*:*:*:*:rust:*:*", "matchCriteriaId": "B9F4365E-174A-4CBB-9F03-34AEA5444DF8", "versionEndExcluding": "0.11.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:pseitz:lz4_flex:0.12.0:*:*:*:*:rust:*:*", "matchCriteriaId": "2A2078FA-C55A-49B1-933D-6D7B33BB5902", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 \"match copy operations,\" allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1."}, {"lang": "es", "value": "lz4_flex es una implementaci\u00f3n pura en Rust de compresi\u00f3n/descompresi\u00f3n LZ4. En las versiones 0.11.5 e inferiores, y 0.12.0, la descompresi\u00f3n de datos LZ4 no v\u00e1lidos puede filtrar informaci\u00f3n sensible de memoria no inicializada o de operaciones de descompresi\u00f3n anteriores. La biblioteca no valida correctamente los valores de desplazamiento durante las 'operaciones de copia de coincidencia' de LZ4, permitiendo lecturas fuera de l\u00edmites del b\u00fafer de salida. Las funciones API basadas en bloques ('decompress_into', 'decompress_into_with_dict', y otras cuando 'safe-decode' est\u00e1 deshabilitado) se ven afectadas, mientras que todas las API de trama no se ven afectadas. El impacto es la exposici\u00f3n potencial de datos sensibles y secretos a trav\u00e9s de entradas LZ4 manipuladas o malformadas. Este problema ha sido solucionado en las versiones 0.11.6 y 0.12.1."}], "id": "CVE-2026-32829", "lastModified": "2026-09-17T12:17:49.007", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32829", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-21T03:02:22.812939Z", "version": "2.0.3"}}]}, "published": "2026-03-20T01:15:56.277", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://rustsec.org/advisories/RUSTSEC-2026-0041.html"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:11800"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:16354"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:19712"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:22862"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-32829"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448271"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32829.json"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-201"}, {"lang": "en", "value": "CWE-823"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-823"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "lz4_flex: lz4_flex's decompression can leak information from uninitialized memory or reused output buffer", "id": "2448271", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448271"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-823", "details": ["No description is available for this CVE."], "name": "CVE-2026-32829", "package_state": [{"cpe": "cpe:/a:redhat:logging:6", "fix_state": "Affected", "package_name": "openshift-logging/vector-rhel9", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:openshift_lightspeed", "fix_state": "Affected", "package_name": "openshift-lightspeed/lightspeed-service-api-rhel9", "product_name": "OpenShift Lightspeed"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-25/lightspeed-chatbot-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-llm-d-inference-scheduler-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-model-registry-job-async-upload-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-03-16T20:48:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32829\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32829\nhttps://github.com/PSeitz/lz4_flex\nhttps://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d\nhttps://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "product": "lz4_flex", "vendor": "pseitz"}], "analysis": {"en": {"generated_at": "2026-03-30T16:30:47.564745+00:00", "value": {"mitigation_remediation": ["Update lz4_flex to version 0.11.6 or newer, or to 0.12.1 or a later release where the issue is fixed."], "summary": {"action": "Immediate patch", "impact": "Information disclosure due to out-of-bounds read during LZ4 decompression"}, "threat_synthesis": {"affected_systems": "The affected product is the lz4_flex library from PSeitz, specifically versions 0.11.5 and earlier, as well as version 0.12.0. The block\u2011based decompression APIs, including decompress_into and decompress_into_with_dict, are vulnerable when the safe-decode feature is disabled. Frame\u2011based APIs remain unaffected.", "description_and_impact": "lZ4_flex, a pure Rust LZ4 compression library, contains a flaw that permits the extraction of secrets from uninitialized memory or from prior decompression operations. The bug arises when invalid LZ4 data causes the library to fail in validating offset values during match copy operations, leading to out-of-bounds reads from the output buffer. The vulnerability is captured by CWE\u2011201 and CWE\u2011823 and results in the potential leakage of sensitive data through crafted or malformed input streams.", "risk_and_exploitability": "The CVSS score of 8.2 indicates a high severity. EPSS is below 1\u202f%, reflecting a low likelihood that the vulnerability is actively exploited in the wild, and it is not listed in CISA\u2019s KEV catalog. Attackers would need to deliver malicious LZ4 payloads that target the vulnerable block\u2011based decompression functions. The impact is confined to environments that process untrusted LZ4 data with this library; as the breach is information disclosure, a successful exploit would expose data or secrets contained in memory."}}}}, "created": "2026-03-19T08:57:13.199229+00:00", "updated": "2026-03-30T20:58:20.966621+00:00", "vendors": ["pseitz", "pseitz$PRODUCT$lz4_flex"]}