---
id: CVE-2026-106453
title: yawkat LZ4 Java provides LZ4 compression for Java
summary: >-
  yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2,
  LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte
  decompressed-length header before validating the compressed input, allowing a
  five-byte attac…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-789
  - CWE-770
vendor: yawkat
product: lz4-java
affected:
  - lz4-java < 1.11.2
patched:
  - 'at.yawk.lz4:lz4-java 1.11.2'
published: '2026-10-06'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T17:16:48.007'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106453'
references:
  - url: >-
      https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a
    label: security-advisories@github.com
  - url: 'https://github.com/yawkat/lz4-java/releases/tag/v1.11.2'
    label: security-advisories@github.com
  - url: 'https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g'
    label: security-advisories@github.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106453.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-106453'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2547132'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-106453'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106453'
  - url: 'https://github.com/advisories/GHSA-6cx8-rjf8-pr8g'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - ghsa
  - maven
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-07T15:39:16.300198Z'
epss: 0.00372
epssPercentile: 0.31273
aliases:
  - GHSA-6cx8-rjf8-pr8g
ecosystem: maven
ingestedAt: '2026-10-06T20:16:42.472Z'
---

## Overview

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-106453)

Affected packages:

- `at.yawk.lz4:lz4-java <= 1.11.1`
- `org.lz4:lz4-java <= 1.8.1`

Patched in:

- `at.yawk.lz4:lz4-java 1.11.2`

Source: https://github.com/advisories/GHSA-6cx8-rjf8-pr8g

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Debezium 3, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, … · no fix planned: Red Hat Fuse 7, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Debezium 3, Red Hat Enterprise Linux 9, … · updated 2026-10-07 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106453.json)