CVE-2026-106452: yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

October 7, 2026

LZ4BlockInputStream grows its compressed-input buffer to the attacker-controlled compressedLen value from the legacy LZ4Block stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap.

References

github.com/advisories/GHSA-4v53-57pg-c464
github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634
github.com/yawkat/lz4-java/releases/tag/v1.11.2
github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464
nvd.nist.gov/vuln/detail/CVE-2026-106452

Code Behaviors & Features

Detect and mitigate CVE-2026-106452 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →