{"id":"CVE-2026-106450","title":"yawkat LZ4 Java provides LZ4 compression for Java","summary":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-f…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-770"],"vendor":"yawkat","product":"lz4-java","affected":["lz4-java < 1.11.4"],"patched":["at.yawk.lz4:lz4-java 1.11.4"],"published":"2026-10-06","updated":"2026-10-09","sourceUpdated":"2026-10-09T02:16:59.843","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106450","references":[{"url":"https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283","label":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","label":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106450.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-106450"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547135"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106450"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106450"},{"url":"https://github.com/advisories/GHSA-gm45-99xc-r7wv"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","maven"],"epss":0.00454,"epssPercentile":0.39216,"aliases":["GHSA-gm45-99xc-r7wv"],"ecosystem":"maven","ingestedAt":"2026-10-06T20:16:42.478Z","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-09T01:44:05.802349Z"},"slug":"CVE-2026-106450","body":"## Overview\n\nyawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-106450)\n\nAffected packages:\n\n- `at.yawk.lz4:lz4-java <= 1.11.3`\n- `org.lz4:lz4-java <= 1.8.1`\n\nPatched in:\n\n- `at.yawk.lz4:lz4-java 1.11.4`\n\nSource: https://github.com/advisories/GHSA-gm45-99xc-r7wv\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Debezium 3, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, … · no fix planned: Red Hat Fuse 7, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Debezium 3, Red Hat Enterprise Linux 9, … · updated 2026-10-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106450.json)","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}