You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@iceberg.apache.org by "varun-lakhyani (via GitHub)" <gi...@apache.org> on 2026/07/11 19:25:19 UTC

[PR] Build: Bump at.yawk.lz4:lz4-java from 1.11.0 to 1.11.1 (CVE-2026-59949) [iceberg]

varun-lakhyani opened a new pull request, #17163:
URL: https://github.com/apache/iceberg/pull/17163

   **Security fix:** [CVE-2026-59949 (GHSA-xx22-p4ch-683r)](https://github.com/yawkat/lz4-java/security/advisories/GHSA-xx22-p4ch-683r) — native streaming XXHash JNI implementations can crash the JVM when passed invalid byte array ranges. Severity: Medium (CVSS 6.5).
   
   **No functional changes:** diff between `1.11.0` and `1.11.1` is limited to XXHash JNI validation and a docs fix — https://github.com/yawkat/lz4-java/compare/v1.11.0...v1.11.1


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org

Re: [PR] Build: Bump at.yawk.lz4:lz4-java from 1.11.0 to 1.11.1 (CVE-2026-59949) [iceberg]

Posted by "varun-lakhyani (via GitHub)" <gi...@apache.org>.
varun-lakhyani closed pull request #17163: Build: Bump at.yawk.lz4:lz4-java from 1.11.0 to 1.11.1 (CVE-2026-59949)
URL: https://github.com/apache/iceberg/pull/17163


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org

Re: [PR] Build: Bump at.yawk.lz4:lz4-java from 1.11.0 to 1.11.1 (CVE-2026-59949) [iceberg]

Posted by "varun-lakhyani (via GitHub)" <gi...@apache.org>.
varun-lakhyani commented on PR #17163:
URL: https://github.com/apache/iceberg/pull/17163#issuecomment-4951241056

   @huaxingao @singhpk234 not sure if this should be handled by Dependabot. Please let me know  


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org

Re: [PR] Build: Bump at.yawk.lz4:lz4-java from 1.11.0 to 1.11.1 (CVE-2026-59949) [iceberg]

Posted by "varun-lakhyani (via GitHub)" <gi...@apache.org>.
varun-lakhyani commented on PR #17163:
URL: https://github.com/apache/iceberg/pull/17163#issuecomment-4951973346

   sure sounds good. closing pr then.
   Thanks 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org

Re: [PR] Build: Bump at.yawk.lz4:lz4-java from 1.11.0 to 1.11.1 (CVE-2026-59949) [iceberg]

Posted by "huaxingao (via GitHub)" <gi...@apache.org>.
huaxingao commented on PR #17163:
URL: https://github.com/apache/iceberg/pull/17163#issuecomment-4951936441

   @varun-lakhyani Thanks for catching the CVE. Dependabot already tracks this — it hasn't opened a PR yet only because of the 7-day cooldown on the gradle ecosystem. Since we don't have a release imminent, I'd lean toward letting Dependabot pick this up after the cooldown rather than merging early. Thanks for the PR anyway!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@iceberg.apache.org
For additional commands, e-mail: issues-help@iceberg.apache.org