lz4-java vulnerabilities

CVEs whose affected-version data names the lz4-java package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

4 CVEsRSS

CVE-2026-106449Low· 3.7

3w ago

yawkat LZ4 Java provides LZ4 compression for Java

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a lon…

▾ Sunlityawkat · lz4-javaEPSS 0.42%via NVD

CVE-2026-106450Medium· 5.3

3w ago

yawkat LZ4 Java provides LZ4 compression for Java

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-f…

▾ Sunlityawkat · lz4-javaEPSS 0.45%via NVD

CVE-2026-106452Medium· 5.3

3w ago

yawkat LZ4 Java provides LZ4 compression for Java

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of…

▾ Sunlityawkat · lz4-javaEPSS 0.45%via NVD

CVE-2026-106453Medium· 5.3

3w ago

yawkat LZ4 Java provides LZ4 compression for Java

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attac…

▾ Sunlityawkat · lz4-javaEPSS 0.37%via NVD