CVE-2026-106450: yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

October 7, 2026

LZ4FrameInputStream allocates two new buffers of the frame’s maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 input bytes.

References

github.com/advisories/GHSA-gm45-99xc-r7wv
github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283
github.com/yawkat/lz4-java/releases/tag/v1.11.4
github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv
nvd.nist.gov/vuln/detail/CVE-2026-106450

Code Behaviors & Features

Detect and mitigate CVE-2026-106450 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →