CVE-2026-106449Low· 3.7▾ Sunlityawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a lon…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
at.yawk.lz4:lz4-java <= 1.11.3org.lz4:lz4-java <= 1.8.1Patched in:
at.yawk.lz4:lz4-java 1.11.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-106450Medium· 5.3yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-106452Medium· 5.3yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-106453Medium· 5.3yawkat LZ4 Java provides LZ4 compression for Java
CVE-2026-116144Low· 3.3ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Stack Overflow via MVG Decoder
CVE-2026-8168Medium· 6.5qt5-qtsvg: qt6-qtsvg: qt: Denial of Service via deeply nested SVG elements (CVE-2026-8168)
CVE-2026-110263Medium· 5.5OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures