CVE-2026-106453

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: GitHub, Inc.

Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106453

EUVD

EUVD-2026-93872

Affected Vendors & Products

Vendor	Product	Version / Range
yawkat	lz4-java	< 1.11.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

The vulnerability in yawkat LZ4 Java library versions prior to 1.11.2 involves the LZ4DecompressorWithLength class trusting a four-byte decompressed-length header without validating the compressed input first. This allows an attacker to provide a five-byte input that declares a large output size, potentially requesting up to 2 GiB of memory and exhausting the JVM heap.

Detection Guidance

This vulnerability can be detected by checking the version of yawkat LZ4 Java in use. If the version is prior to 1.11.2, the system is vulnerable. Commands to check the version depend on how the library is integrated into your application or build system.

Impact Analysis

This vulnerability can lead to denial-of-service (DoS) attacks by crashing the Java Virtual Machine (JVM) due to excessive memory consumption. It may cause applications using the affected library to become unresponsive or terminate unexpectedly.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA by enabling denial-of-service (DoS) attacks through heap exhaustion, which may disrupt services handling sensitive data. However, the provided CVE details do not explicitly link this issue to compliance requirements.

Mitigation Strategies

Upgrade yawkat LZ4 Java to version 1.11.2 or later to address the vulnerability. If upgrading is not immediately possible, review and restrict input handling in decompression operations to prevent large allocations.

Hi! I’m here to help you understand CVE-2026-106453. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70