CVE-2026-106449: yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

October 7, 2026

When LZ4BlockInputStream is configured with stopOnEmptyBlock = false (the mode for reading concatenated block streams), it handles each empty block by calling refill() recursively. A long run of empty blocks exhausts the thread stack and throws StackOverflowError out of read() or skip().

References

github.com/advisories/GHSA-343h-94h5-c4wr
github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8
github.com/yawkat/lz4-java/releases/tag/v1.11.4
github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr
nvd.nist.gov/vuln/detail/CVE-2026-106449

Code Behaviors & Features

Detect and mitigate CVE-2026-106449 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →