CVE-2026-106452

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.2

Description The refill() function in net.jpountz.lz4.LZ4BlockInputStream fails to properly validate the compressedLen field in a legacy LZ4Block header. While it checks that the value is non-negative, it allocates a compressed-input buffer based on this attacker-controlled size before reading the actual payload data. This allows a specially crafted header-only stream to request an allocation of nearly 2 GiB, leading to the exhaustion of the JVM heap. This occurs because vulnerable readers accept non-canonical oversized compressed blocks, whereas canonical writers typically emit raw blocks when compression does not reduce the size of the original block.

Recommendations Update to version 1.11.2.