CVE-2026-106452

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106452

EUVD

EUVD-2026-93871

Affected Vendors & Products

Vendor	Product	Version / Range
yawkat	lz4-java	< 1.11.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects yawkat LZ4 Java library versions before 1.11.2. It involves a flaw in the LZ4BlockInputStream class where the refill() method checks if the compressedLen field in a legacy LZ4Block header is nonnegative but then allocates a buffer of that size before reading data. An attacker can craft a malicious header requesting a near-2 GiB allocation, causing the JVM heap to be exhausted.

Detection Guidance

This vulnerability can be detected by checking the version of yawkat LZ4 Java in use. If the version is prior to 1.11.2, the system is vulnerable. No specific commands are provided in the context to detect this vulnerability directly.

Impact Analysis

This vulnerability can lead to denial-of-service (DoS) attacks by causing the JVM to run out of memory. An attacker could send specially crafted data to a vulnerable application, triggering excessive memory allocation and crashing the system.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by enabling denial-of-service (DoS) attacks that disrupt system availability, which is a requirement under both regulations. The heap exhaustion caused by oversized allocations may lead to service unavailability, violating availability principles in GDPR Article 32 and HIPAA Security Rule requirements for ensuring access to protected health information.

Mitigation Strategies

Immediately upgrade yawkat LZ4 Java to version 1.11.2 or later to address the vulnerability. Ensure that any applications using this library are updated accordingly.

Hi! I’m here to help you understand CVE-2026-106452. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70