CVE-2026-106453
MediumCVSS 5.3Summary
In yawkat LZ4 Java prior to 1.11.2, LZ4DecompressorWithLength trusts the four-byte decompressed-length header before validating input, allowing a five-byte input to request up to ~2 GiB and exhaust the JVM heap. Overloads writing to a caller-provided buffer are not affected.
Risk Assessment
An attacker can remotely cause memory exhaustion (OutOfMemoryError) and crash the Java application.
Recommendation
Update yawkat LZ4 Java to version 1.11.2 or later.
Other vulnerabilities in yawkat LZ4 Java
See all- CVE-2026-106452Medium
In yawkat LZ4 Java prior to 1.11.2, LZ4BlockInputStream.refill() validates the compressedLen field as nonnegative but allocates a buffer of that attacker-controlled size before reading payload data. A header-only stream can request a near-2 GiB allocation and exhaust the JVM heap.
- CVE-2026-106451High
The yawkat LZ4 Java library versions 1.7.0 through 1.11.4 contain a vulnerability in the insecure creation of a temporary file. An attacker with access to a shared temporary directory can replace the native library file before it is loaded, potentially leading to code execution in the victim's context.
- CVE-2026-106450Medium
In yawkat LZ4 Java prior to 1.11.4, LZ4FrameInputStream.readHeader() allocates two 4 MiB block buffers for maximum-block-size frame headers, and the default concatenated-frame mode allows streams with many minimal empty frames to trigger ~8 MiB allocation per 11 input bytes without producing output.
- CVE-2026-106449Low
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption.
- CVE-2026-59949Medium
In yawkat LZ4 Java before version 1.11.1, JNI-backed XXHash functions fail to validate the byte array and off/len arguments, allowing null arrays or oversized ranges to reach native code. This can cause reads outside the Java array and fatal JVM termination. Fixed in version 1.11.1.
Original NVD description (English source)
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS