CVE-2026-106453

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.2

Description The LZ4DecompressorWithLength component trusts the four-byte decompressed-length header via the getDecompressedLength() function before validating the compressed input. This allows an attacker to provide a five-byte input with a header declaring a large output size, potentially requesting up to 2 GiB and exhausting the JVM heap. This issue affects convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor that allocate the untrusted size. Overloads writing to a caller-provided destination buffer are not affected.

Recommendations Update yawkat LZ4 Java to version 1.11.2.