CVE-2026-106449

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.4

Description A flaw exists in the net.jpountz.lz4.LZ4BlockInputStream class when the stopOnEmptyBlock variable is set to false. In this configuration, the system handles well-formed empty LZ4Blocks by recursively calling the refill() function. An attacker can provide a compressed stream containing a long sequence of empty blocks to exhaust the decoding thread's stack, resulting in a StackOverflowError, which is a runtime error occurring when a program's call stack exceeds its allocated limit.

Recommendations Update to version 1.11.4. As a temporary mitigation, ensure the stopOnEmptyBlock variable is set to true.