CVE catalog
CVE-2019-17543
lz4: CVE-2019-17543
- Severity
- High · CVSS 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 10.45% · Oct 25, 2026
LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | lz4 | sid | 1.10.0-10 | fixed |
| Debian | lz4 | forky | 1.10.0-10 | fixed |
| Debian | lz4 | trixie | 1.10.0-4 | fixed |
| Debian | lz4 | bookworm | 1.9.4-1 | fixed |
| Cpe | lz4 | Not reported | 1.9.2 | fixed |
| Alpine | lz4 | 3.10 | 1.9.1-r1 | fixed |
| Alpine | lz4 | 3.11 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.12 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.13 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.14 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.15 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.16 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.17 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.18 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.19 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.20 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.21 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.22 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.23 | 1.9.2-r0 | fixed |
| Alpine | lz4 | 3.24 | 1.9.2-r0 | fixed |
| Suse | lz4 | linux enterprise module for basesystem 15 | 1.8.0-3.5.1 | fixed |
| Suse | lz4 | linux enterprise module for basesystem 15 sp1 | 1.8.0-3.5.1 | fixed |
| Suse | lz4 | linux enterprise software development kit 12 sp5 | 1.8.0-3.3.1 | fixed |
| Opensuse | lz4 | leap 15.0 | 1.8.0-lp150.2.3.1 | fixed |
| Opensuse | lz4-test | leap 15.0 | 1.8.0-lp150.2.3.1 | fixed |
| Opensuse | lz4 | tumbleweed | 1.9.3-1.5 | fixed |
| Opensuse | lz4 | leap 15.1 | 1.8.0-lp151.3.3.1 | fixed |
| Opensuse | lz4-test | leap 15.1 | 1.8.0-lp151.3.3.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | lz4 | source | sid | 1.9.2-1 | low | Not reported | [943680] |
| Debian | lz4 | source | forky | 1.9.2-1 | low | Not reported | [943680] |
| Debian | lz4 | source | trixie | 1.9.2-1 | low | Not reported | [943680] |
| Debian | lz4 | source | bookworm | 1.9.2-1 | low | Not reported | [943680] |
| Cpe | lz4 | cpe | Not reported | 1.9.2 | Not reported | NVD-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.10 | 1.9.1-r1 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.11 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.12 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.13 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.14 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.15 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.16 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.17 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.18 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.19 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.20 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.21 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.22 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.23 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Alpine | lz4 | apk | 3.24 | 1.9.2-r0 | Not reported | ALPINE-CVE-2019-17543 | Not reported |
| Suse | lz4 | rpm | linux enterprise module for basesystem 15 | 1.8.0-3.5.1 | Not reported | SUSE-SU-2019:2757-1 | Not reported |
| Suse | lz4 | rpm | linux enterprise module for basesystem 15 sp1 | 1.8.0-3.5.1 | Not reported | SUSE-SU-2019:2757-1 | Not reported |
| Suse | lz4 | rpm | linux enterprise software development kit 12 sp5 | 1.8.0-3.3.1 | Not reported | SUSE-SU-2021:1613-1 | Not reported |
| Opensuse | lz4 | rpm | leap 15.0 | 1.8.0-lp150.2.3.1 | Not reported | OPENSUSE-SU-2019:2398-1 | Not reported |
| Opensuse | lz4-test | rpm | leap 15.0 | 1.8.0-lp150.2.3.1 | Not reported | OPENSUSE-SU-2019:2398-1 | Not reported |
| Opensuse | lz4 | rpm | tumbleweed | 1.9.3-1.5 | Not reported | OPENSUSE-SU-2024:11034-1 | Not reported |
| Opensuse | lz4 | rpm | leap 15.1 | 1.8.0-lp151.3.3.1 | Not reported | OPENSUSE-SU-2019:2399-1 | Not reported |
| Opensuse | lz4-test | rpm | leap 15.1 | 1.8.0-lp151.3.3.1 | Not reported | OPENSUSE-SU-2019:2399-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [liblz4-1]Unknown
Source package: [lz4]
Details (1)
1.10.0-2.8· x86_64 · tumbleweedUnknown · Fixed:
1.9.3-1.5Version impact unknown
dsa · lz4 · opensuse · tumbleweed
- [liblz4-1-32bit]Unknown
Source package: [lz4]
Details (1)
1.10.0-2.8· x86_64 · tumbleweedUnknown · Fixed:
1.9.3-1.5Version impact unknown
dsa · lz4 · opensuse · tumbleweed
- [liblz4-1-x86-64-v3]Unknown
Source package: [lz4]
Details (1)
1.10.0-2.8· x86_64 · tumbleweedUnknown · Fixed:
1.9.3-1.5Version impact unknown
dsa · lz4 · opensuse · tumbleweed
- [liblz4-devel]Unknown
Source package: [lz4]
Details (1)
1.10.0-2.8· x86_64 · tumbleweedUnknown · Fixed:
1.9.3-1.5Version impact unknown
dsa · lz4 · opensuse · tumbleweed
- [lz4]Fixed
Source package: [lz4]
Details (1)
1.10.0-2.8· x86_64 · tumbleweedFixed · Fixed:
1.9.3-1.5dsa · lz4 · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [liblz4-1]Fixed
Source package: [lz4]
Details (2)
1.9.4-1· amd64 · bookwormFixed · Fixed:
1.9.2-1dsa · lz4 · debian · bookworm
1.9.4-1· arm64 · bookwormFixed · Fixed:
1.9.2-1dsa · lz4 · debian · bookworm
- [liblz4-dev]Fixed
Source package: [lz4]
Details (2)
1.9.4-1· amd64 · bookwormFixed · Fixed:
1.9.2-1dsa · lz4 · debian · bookworm
1.9.4-1· arm64 · bookwormFixed · Fixed:
1.9.2-1dsa · lz4 · debian · bookworm
- [liblz4-tool]Fixed
Source package: [lz4]
Details (2)
1.9.4-1· all · bookwormFixed · Fixed:
1.9.2-1dsa · lz4 · debian · bookworm
1.9.4-1· all · bookwormFixed · Fixed:
1.9.2-1dsa · lz4 · debian · bookworm
- [lz4]Fixed
Details (2)
1.9.4-1· amd64 · bookwormFixed · Fixed:
1.9.2-1dsa · lz4 · debian · bookworm
1.9.4-1· arm64 · bookwormFixed · Fixed:
1.9.2-1dsa · lz4 · debian · bookworm
Observed:
References
- [https://access.redhat.com/errata/RHSA-2025:11035]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2025_11035.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2019-17543]
- [https://osv.dev/vulnerability/ALPINE-CVE-2019-17543]
- [https://osv.dev/vulnerability/SUSE-SU-2019:2757-1]
- [https://osv.dev/vulnerability/SUSE-SU-2021:1613-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2019-17543]
- [https://osv.dev/vulnerability/openSUSE-SU-2019:2398-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2019:2399-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:11034-1]
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-284-16.json]
- [https://security-tracker.debian.org/tracker/CVE-2019-17543]
- [https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1905.json]
[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]