CVE-2026-106450

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.4

Description The readHeader() function in net.jpountz.lz4.LZ4FrameInputStream allocates two 4 MiB block buffers when a maximum-block-size frame header is processed. In the default concatenated-frame mode, an attacker can provide streams with numerous minimal empty frames, triggering approximately 8 MiB of memory allocation for every 11 input bytes. This process consumes CPU and garbage-collection time without producing decompressed output, rendering decompressed-size limits ineffective. The readSingleFrame mode is not affected.

Recommendations Update to version 1.11.4.