---
id: CVE-2026-106450
title: yawkat LZ4 Java provides LZ4 compression for Java
summary: >-
  yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4,
  net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block
  buffers whenever a maximum-block-size frame header is read, and the default
  concatenated-f…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-770
vendor: yawkat
product: lz4-java
affected:
  - lz4-java < 1.11.4
patched:
  - 'at.yawk.lz4:lz4-java 1.11.4'
published: '2026-10-06'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T02:16:59.843'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106450'
references:
  - url: >-
      https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283
    label: security-advisories@github.com
  - url: 'https://github.com/yawkat/lz4-java/releases/tag/v1.11.4'
    label: security-advisories@github.com
  - url: 'https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv'
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106450.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-106450'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2547135'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-106450'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106450'
  - url: 'https://github.com/advisories/GHSA-gm45-99xc-r7wv'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - ghsa
  - maven
epss: 0.00454
epssPercentile: 0.39216
aliases:
  - GHSA-gm45-99xc-r7wv
ecosystem: maven
ingestedAt: '2026-10-06T20:16:42.478Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-09T01:44:05.802349Z'
---

## Overview

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-106450)

Affected packages:

- `at.yawk.lz4:lz4-java <= 1.11.3`
- `org.lz4:lz4-java <= 1.8.1`

Patched in:

- `at.yawk.lz4:lz4-java 1.11.4`

Source: https://github.com/advisories/GHSA-gm45-99xc-r7wv

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Debezium 3, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, … · no fix planned: Red Hat Fuse 7, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Debezium 3, Red Hat Enterprise Linux 9, … · updated 2026-10-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106450.json)