CVE-2026-106453: yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

October 7, 2026

LZ4DecompressorWithLength.decompress(byte[], int) allocates whatever size the 4-byte length header declares, before it reads a single byte of compressed data. A 5-byte input whose header says 0x40000000 makes the JVM commit a gigabyte and can cause heap exhaustion.

References

github.com/advisories/GHSA-6cx8-rjf8-pr8g
github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a
github.com/yawkat/lz4-java/releases/tag/v1.11.2
github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g
nvd.nist.gov/vuln/detail/CVE-2026-106453

Code Behaviors & Features

Detect and mitigate CVE-2026-106453 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →