{"id":"CVE-2026-106453","title":"yawkat LZ4 Java provides LZ4 compression for Java","summary":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attac…","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-789","CWE-770"],"vendor":"yawkat","product":"lz4-java","affected":["lz4-java < 1.11.2"],"patched":["at.yawk.lz4:lz4-java 1.11.2"],"published":"2026-10-06","updated":"2026-10-07","sourceUpdated":"2026-10-07T17:16:48.007","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-106453","references":[{"url":"https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a","label":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/releases/tag/v1.11.2","label":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106453.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-106453"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2547132"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106453"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106453"},{"url":"https://github.com/advisories/GHSA-6cx8-rjf8-pr8g"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","maven"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-07T15:39:16.300198Z"},"epss":0.00372,"epssPercentile":0.30925,"aliases":["GHSA-6cx8-rjf8-pr8g"],"ecosystem":"maven","ingestedAt":"2026-10-06T20:16:42.472Z","slug":"CVE-2026-106453","body":"## Overview\n\nyawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-106453)\n\nAffected packages:\n\n- `at.yawk.lz4:lz4-java <= 1.11.1`\n- `org.lz4:lz4-java <= 1.8.1`\n\nPatched in:\n\n- `at.yawk.lz4:lz4-java 1.11.2`\n\nSource: https://github.com/advisories/GHSA-6cx8-rjf8-pr8g\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Debezium 3, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, … · no fix planned: Red Hat Fuse 7, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Debezium 3, Red Hat Enterprise Linux 9, … · updated 2026-10-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106453.json)","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}