StackRadar

CVE-2026-59949

Medium

Advisory

Published 24 Jul 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.5
base score, highest
EPSS
0.005
38th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
89
of 17,781 indexed, latest versions
Container images
87
deployed by those charts
Fix available
1 of 1
affected package

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

Carried by container images the latest versions of 89 of 17,781 indexed charts deploy, on 87 images.

Affected packageAffected versionsFixed inImages
lz4-javamaven1.10.1, 1.10.2, 1.10.4, 1.11.01.11.187
OSV records
GHSA-xx22-p4ch-683r

Charts affected

89 by stars
ChartLatestAffected imagesRadar Score
metabasepmint932.27.61 of 1See more

metabase pmint93 2.27.6

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
metabase/metabase:v0.61.1.x9491ed11c901
lz4-java@1.10.4
1.11.1

Open the chart page →

1,639
kafka-uikafka-uiVerified publisher1.6.51 of 1See more

kafka-ui kafka-ui 1.6.5

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
lz4-java@1.10.1
1.11.1

Open the chart page →

729
strimzi-kafka-operatorstrimzi-kafka-operator1.2.01 of 1See more

strimzi-kafka-operator strimzi-kafka-operator 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:1.2.077f8fa8121a6
lz4-java@1.10.2
1.11.1

Open the chart page →

69
trinotrino1.42.21 of 1See more

trino trino 1.42.2

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
trinodb/trino:4801565e8cac299
lz4-java@1.10.4
1.11.1

Open the chart page →

1,309
graylogkong-zVerified publisher3.0.321 of 5See more

graylog kong-z 3.0.32

1 of the 5 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.19.68690b204fe91
lz4-java@1.10.1
1.11.1

Open the chart page →

2,699
strimzi-kafka-operatorstrimzi1.2.01 of 1See more

strimzi-kafka-operator strimzi 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:1.2.077f8fa8121a6
lz4-java@1.10.2
1.11.1

Open the chart page →

69
penpotpenpotOfficialVerified publisher1.9.01 of 4See more

penpot penpot 1.9.0

1 of the 4 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
penpotapp/backend:2.17.2770b55f6e51b
lz4-java@1.11.0
1.11.1

Open the chart page →

4,314
apim3graviteeioVerified publisher4.12.192 of 4See more

apim3 graviteeio 4.12.19

2 of the 4 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
graviteeio/apim-gateway:4.12.19-debian05fd67a93056
lz4-java@1.10.1
1.11.1
graviteeio/apim-management-api:4.12.19-debian27374522cd04
lz4-java@1.10.1
1.11.1

Open the chart page →

4,806
polarisapache-polarisOfficialVerified publisher1.3.0-incubating1 of 1See more

polaris apache-polaris 1.3.0-incubating

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
apache/polaris:lateste66366e783f1
lz4-java@1.10.1
1.11.1

Open the chart page →

455
cloudbeaveravistoVerified publisher1.1.71 of 1See more

cloudbeaver avisto 1.1.7

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
dbeaver/cloudbeaver:26.1.287ab86d00f8c
lz4-java@1.10.1
1.11.1

Open the chart page →

1,710
druiddruid-helmVerified publisher37.0.21 of 3See more

druid druid-helm 37.0.2

1 of the 3 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
apache/druid:37.0.00116fb802786
lz4-java@1.10.2
1.11.1

Open the chart page →

3,812
cassandrakubelauncherVerified publisher0.1.271 of 1See more

cassandra kubelauncher 0.1.27

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
ghcr.io/kubelauncher/cassandradigest-pinnedb66aba320083
lz4-java@1.10.1
1.11.1

Open the chart page →

1,442
grayloggroundhog2k0.13.101 of 1See more

graylog groundhog2k 0.13.10

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
graylog/graylog:7.1.9598bd41fefd5
lz4-java@1.10.4
1.11.1

Open the chart page →

1,074
elasticsearch-clusterwiremindVerified publisher4.5.21 of 2See more

elasticsearch-cluster wiremind 4.5.2

1 of the 2 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
library/elasticsearch:8.19.1289729a95066a
lz4-java@1.10.1
1.11.1

Open the chart page →

2,283
grayloggraylog2OfficialVerified publisher2.0.01 of 2See more

graylog graylog2 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
graylog/graylog-enterprise:7.1.88a1f641cd7aa
lz4-java@1.10.4
1.11.1

Open the chart page →

1,500
kpowfactorhouseOfficialVerified publisher1.0.831 of 1See more

kpow factorhouse 1.0.83

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
factorhouse/kpow:96.4f9ce9b16b3a7
lz4-java@1.10.1
1.11.1

Open the chart page →

59
thingsboardcetic0.1.21 of 2See more

thingsboard cetic 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
thingsboard/tb-postgres:latest2d17e4e36edc
lz4-java@1.10.1
1.11.1

Open the chart page →

5,235
apimgraviteeioVerified publisher4.12.192 of 4See more

apim graviteeio 4.12.19

2 of the 4 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
graviteeio/apim-gateway:4.12.19-debian05fd67a93056
lz4-java@1.10.1
1.11.1
graviteeio/apim-management-api:4.12.19-debian27374522cd04
lz4-java@1.10.1
1.11.1

Open the chart page →

4,806
infrahub-enterpriseinfrahub-enterpriseVerified publisher4.19.21 of 5See more

infrahub-enterprise infrahub-enterprise 4.19.2

1 of the 5 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
library/neo4j:2026.05.0-enterprise2caf944aa4a5
lz4-java@1.11.0
1.11.1

Open the chart page →

10,530
metabaseone-acre-fundVerified publisher0.1.111 of 3See more

metabase one-acre-fund 0.1.11

1 of the 3 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
metabase/metabase:latest4093784be49f
lz4-java@1.10.4
1.11.1

Open the chart page →

26
kafkacloudpirates-kafkaVerified publisher0.1.61 of 1See more

kafka cloudpirates-kafka 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
apache/kafka:4.3.177e3df905404
lz4-java@1.10.2
1.11.1

Open the chart page →

549
enavenav-service-architectureVerified publisher0.0.73 of 10See more

enav enav-service-architecture 0.0.7

3 of the 10 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
lz4-java@1.10.1
1.11.1
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
lz4-java@1.10.1
1.11.1
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
lz4-java@1.10.1
1.11.1

Open the chart page →

15,860
kpow-cefactorhouseOfficialVerified publisher1.0.811 of 1See more

kpow-ce factorhouse 1.0.81

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
factorhouse/kpow-ce:96.466b08cc9e943
lz4-java@1.10.1
1.11.1

Open the chart page →

59
amgraviteeioVerified publisher4.12.62 of 3See more

am graviteeio 4.12.6

2 of the 3 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
graviteeio/am-gateway:4.12.607b7f6dc267a
lz4-java@1.10.1
1.11.1
graviteeio/am-management-api:4.12.6a8eb04ee0c70
lz4-java@1.10.1
1.11.1

Open the chart page →

2,088
hazelcast-enterprisehazelcastVerified publisher5.15.11 of 2See more

hazelcast-enterprise hazelcast 5.15.1

1 of the 2 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
hazelcast/hazelcast-enterprise:5.7.1cf244da155eb
lz4-java@1.10.1
1.11.1

Open the chart page →

174
kafkahelmforgeVerified publisher1.3.141 of 1See more

kafka helmforge 1.3.14

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
apache/kafka:4.3.177e3df905404
lz4-java@1.10.2
1.11.1

Open the chart page →

549
auditflowlabs64io-helm-chartsVerified publisher0.12.11 of 3See more

auditflow labs64io-helm-charts 0.12.1

1 of the 3 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
labs64/auditflowdigest-pinnedc7b26d3ca11c
lz4-java@1.10.1
1.11.1

Open the chart page →

1,446
opentelemetry-demoopentelemetry-helmVerified publisher0.41.12 of 34See more

opentelemetry-demo opentelemetry-helm 0.41.1

2 of the 34 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
ghcr.io/open-telemetry/demo:3.0.0-kafka0601750a3ca4
lz4-java@1.10.2
1.11.1
ghcr.io/open-telemetry/demo:3.0.0-fraud-detection1cdfd1bcf476
lz4-java@1.10.2
1.11.1

Open the chart page →

22,420
opikopikOfficialVerified publisher2.2.591 of 13See more

opik opik 2.2.59

1 of the 13 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
ghcr.io/comet-ml/opik/opik-backend:2.2.5950a7aa0562f5
lz4-java@1.10.4
1.11.1

Open the chart page →

14,334
aktoakto0.2.02 of 7See more

akto akto 0.2.0

2 of the 7 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-dashboard:latestb53a854bd7c1
lz4-java@1.10.1
1.11.1
public.ecr.aws/aktosecurity/akto-api-security-runtime:latestfacdfba6d4e4
lz4-java@1.10.1
1.11.1

Open the chart page →

13,613
akto-central-setupakto1.1.104 of 5See more

akto-central-setup akto 1.1.10

4 of the 5 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
aktosecurity/akto-threat-detection-backend:1.15.7a6c1b933517f
lz4-java@1.10.1
1.11.1
public.ecr.aws/aktosecurity/akto-api-security-dashboard:1.69.2b53a854bd7c1
lz4-java@1.10.1
1.11.1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:1.66.9138c8b82c398
lz4-java@1.10.1
1.11.1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
lz4-java@1.10.1
1.11.1

Open the chart page →

4,905
akto-dashboardakto0.1.71 of 1See more

akto-dashboard akto 0.1.7

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
aktosecurity/akto-api-security-dashboard:latest3aeaee66bc66
lz4-java@1.10.1
1.11.1

Open the chart page →

1,162
akto-dbabsakto0.1.91 of 1See more

akto-dbabs akto 0.1.9

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:latestf669a6eacf8c
lz4-java@1.10.1
1.11.1

Open the chart page →

1,125
akto-mini-runtimeakto0.7.221 of 3See more

akto-mini-runtime akto 0.7.22

1 of the 3 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
lz4-java@1.10.1
1.11.1

Open the chart page →

2,741
akto-mini-testingakto1.45.71 of 5See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
lz4-java@1.10.1
1.11.1

Open the chart page →

6,486
akto-regional-setupakto1.3.13 of 9See more

akto-regional-setup akto 1.3.1

3 of the 9 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
aktosecurity/data-ingestion-service:1.5.35d4eab1c36b9
lz4-java@1.10.1
1.11.1
public.ecr.aws/aktosecurity/akto-threat-detection:1.16.2a47eb6cc17ea
lz4-java@1.10.1
1.11.1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.28e01c0305844
lz4-java@1.10.1
1.11.1

Open the chart page →

7,603
akto-runtimeakto0.1.81 of 2See more

akto-runtime akto 0.1.8

1 of the 2 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
lz4-java@1.10.1
1.11.1

Open the chart page →

1,411
akto-threat-backendakto0.1.52 of 2See more

akto-threat-backend akto 0.1.5

2 of the 2 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
aktosecurity/akto-threat-detection-backend:latest15ebb75b94dc
lz4-java@1.10.1
1.11.1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
lz4-java@1.10.1
1.11.1

Open the chart page →

1,490
akto-threat-clientakto0.2.02 of 2See more

akto-threat-client akto 0.2.0

2 of the 2 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
public.ecr.aws/aktosecurity/akto-threat-detection:latest3f103ce347ce
lz4-java@1.10.1
1.11.1
public.ecr.aws/aktosecurity/confluentinc-cp-kafka:8.2.2-1-ubi98e01c0305844
lz4-java@1.10.1
1.11.1

Open the chart page →

1,523
kafka-uiappscodeVerified publisher2026.3.301 of 1See more

kafka-ui appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
ghcr.io/kafbat/kafka-ui:v1.5.07cda86a33344
lz4-java@1.10.1
1.11.1

Open the chart page →

729
kafka-connectdasmeta1.0.21 of 3See more

kafka-connect dasmeta 1.0.2

1 of the 3 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
confluentinc/cp-schema-registry:latestf0cfd047a839
lz4-java@1.10.2
1.11.1

Open the chart page →

532
metabasedasmeta0.1.01 of 1See more

metabase dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
metabase/metabase:v0.63.1.124f150effd484
lz4-java@1.10.4
1.11.1

Open the chart page →

804
datagrokdatagrok1.0.31 of 7See more

datagrok datagrok 1.0.3

1 of the 7 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
datagrok/grok_connect:latestf5876d3aebb8
lz4-java@1.10.1
1.11.1

Open the chart page →

2,328
datagrok_grok_connectdatagrok1.0.01 of 1See more

datagrok_grok_connect datagrok 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
datagrok/grok_connect:latestf5876d3aebb8
lz4-java@1.10.1
1.11.1

Open the chart page →

1,626
factor-platformfactorhouseVerified publisher0.0.41 of 1See more

factor-platform factorhouse 0.0.4

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
factorhouse/factor-platform:96.414728f9fd80f
lz4-java@1.10.1
1.11.1

Open the chart page →

59
mod-agreementsfolio-org0.1.321 of 1See more

mod-agreements folio-org 0.1.32

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
folioci/mod-agreements:latest29c3f233a498
lz4-java@1.10.1
1.11.1

Open the chart page →

1,874
mod-auditfolio-org0.1.361 of 1See more

mod-audit folio-org 0.1.36

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
folioci/mod-audit:latest88f40730ed45
lz4-java@1.10.1
1.11.1

Open the chart page →

267
mod-circulationfolio-org0.1.351 of 1See more

mod-circulation folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
folioci/mod-circulation:latest3eecd2ac2d8a
lz4-java@1.10.1
1.11.1

Open the chart page →

497
mod-circulation-storagefolio-org0.1.351 of 1See more

mod-circulation-storage folio-org 0.1.35

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
folioci/mod-circulation-storage:latest6bdddcafbc0f
lz4-java@1.10.1
1.11.1

Open the chart page →

658
mod-data-export-springfolio-org0.1.41 of 1See more

mod-data-export-spring folio-org 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-59949.

Container imageDigestPackageFixed in
folioci/mod-data-export-spring:latestf1d7caf4544b
lz4-java@1.10.1
1.11.1

Open the chart page →

1,253

Container images carrying it

87 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
folioci/mod-source-record-storage:latesta1434881eeb7
lz4-java@1.10.1
1.11.1
1
folioci/mod-users:latest6f60033321b0
lz4-java@1.10.2
1.11.1
1
graviteeio/am-gateway:4.12.607b7f6dc267a
lz4-java@1.10.1
1.11.1
1
graviteeio/am-management-api:4.12.6a8eb04ee0c70
lz4-java@1.10.1
1.11.1
1
graylog/graylog:7.1.9598bd41fefd5
lz4-java@1.10.4
1.11.1
1
graylog/graylog-enterprise:7.1.88a1f641cd7aa
lz4-java@1.10.4
1.11.1
1
hazelcast/hazelcast:latestf086bf0ecb23
lz4-java@1.10.1
1.11.1
1
hazelcast/hazelcast-enterprise:5.7.1cf244da155eb
lz4-java@1.10.1
1.11.1
1
labs64/auditflowc7b26d3ca11c
lz4-java@1.10.1
1.11.1
1
library/cassandra:4.0093ee8ee5eb2
lz4-java@1.10.1
1.11.1
1
library/neo4j:2026.05.0-enterprise2caf944aa4a5
lz4-java@1.11.0
1.11.1
1
metabase/metabase:latest4093784be49f
lz4-java@1.10.4
1.11.1
1
metabase/metabase:v0.63.1.124f150effd484
lz4-java@1.10.4
1.11.1
1
metabase/metabase:v0.63.16c6dd0c6a7861
lz4-java@1.10.4
1.11.1
1
opennms/sentinel:36.0.288869082a14f
lz4-java@1.10.2
1.11.1
1
opensearchproject/opensearch:2.19.68690b204fe91
lz4-java@1.10.1
1.11.1
1
openzipkin/zipkin-slim:3.6.0a69e1057df36
lz4-java@1.10.1
1.11.1
1
penpotapp/backend:2.17.2770b55f6e51b
lz4-java@1.11.0
1.11.1
1
thingsboard/tb-postgres:latest2d17e4e36edc
lz4-java@1.10.1
1.11.1
1
trinodb/trino:4801565e8cac299
lz4-java@1.10.4
1.11.1
1
trinodb/trino:4815b5e0a97f599
lz4-java@1.11.0
1.11.1
1
ghcr.io/comet-ml/opik/opik-backend:2.2.5950a7aa0562f5
lz4-java@1.10.4
1.11.1
1
ghcr.io/gla-rad/enav-aton-admin-service:latestcf85570b1324
lz4-java@1.10.1
1.11.1
1
ghcr.io/gla-rad/enav-aton-service:latest3be878690629
lz4-java@1.10.1
1.11.1
1
ghcr.io/gla-rad/enav-msg-broker:latest6fe372e4e481
lz4-java@1.10.1
1.11.1
1
ghcr.io/kubelauncher/cassandrab66aba320083
lz4-java@1.10.1
1.11.1
1
ghcr.io/open-telemetry/demo:3.0.0-kafka0601750a3ca4
lz4-java@1.10.2
1.11.1
1
ghcr.io/open-telemetry/demo:3.0.0-fraud-detection1cdfd1bcf476
lz4-java@1.10.2
1.11.1
1
ghcr.io/radar-base/radar-gateway/radar-gateway:0.9.4219d894aa7a6
lz4-java@1.10.1
1.11.1
1
ghcr.io/radar-base/radar-schemas/radar-schemas-tools:0.8.16c442e8bfe6b4
lz4-java@1.10.1
1.11.1
1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:1.66.9138c8b82c398
lz4-java@1.10.1
1.11.1
1
public.ecr.aws/aktosecurity/akto-api-security-database-abstractor:latestf669a6eacf8c
lz4-java@1.10.1
1.11.1
1
public.ecr.aws/aktosecurity/akto-api-security-runtime:latestfacdfba6d4e4
lz4-java@1.10.1
1.11.1
1
public.ecr.aws/aktosecurity/akto-threat-detection:latest3f103ce347ce
lz4-java@1.10.1
1.11.1
1
public.ecr.aws/aktosecurity/akto-threat-detection:1.16.2a47eb6cc17ea
lz4-java@1.10.1
1.11.1
1
quay.io/kannika/kannika-api:0.18.0bcf9906d5a3c
lz4-java@1.10.2
1.11.1
1
quay.io/strimzi/operator:latest1af5dc3dcf8c
lz4-java@1.10.2
1.11.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.