CVE-2026-106450

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106450

EUVD

EUVD-2026-93865

Affected Vendors & Products

Vendor	Product	Version / Range
yawkat	lz4-java	< 1.11.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects yawkat LZ4 Java library versions before 1.11.4. When processing LZ4 compressed streams with many minimal empty frames, the library allocates two 4 MiB block buffers per frame header. Attackers can exploit this by sending crafted streams to cause excessive memory allocation (about 8 MiB per 11 input bytes) without producing decompressed output, leading to resource exhaustion.

Detection Guidance

This vulnerability can be detected by checking the version of yawkat LZ4 Java in use. If the version is below 1.11.4, the system is vulnerable. Commands like 'find / -name "lz4-java*.jar" 2>/dev/null' or checking dependency files (e.g., Maven's pom.xml) can help identify the version.

Impact Analysis

If you use the affected LZ4 Java library in your application, an attacker could send specially crafted data to consume excessive memory and CPU resources. This may cause your application to slow down, crash, or become unresponsive due to high memory usage and garbage collection overhead.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a denial-of-service issue causing resource exhaustion rather than a data breach or privacy violation. However, it could indirectly impact compliance by disrupting system availability, which may violate availability requirements in these regulations.

Mitigation Strategies

Upgrade yawkat LZ4 Java to version 1.11.4 or later. If using Maven, update the dependency in pom.xml to specify version 1.11.4. For other package managers, use the appropriate command to update the library.

Hi! I’m here to help you understand CVE-2026-106450. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70