CVE-2026-106450: yawkat LZ4 Java - Excessive Memory Allocation in LZ4FrameInputStream
Summary
CVE-2026-106450: LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Affects at.yawk.lz4:lz4-java versions < 1.11.4. Fixed in 1.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The LZ4 Java library, specifically the at.yawk.lz4 and org.lz4 packages, is designed for high-speed compression and decompression of data. It is widely used in applications requiring efficient data handling. However, a vulnerability has been identified in the LZ4FrameInputStream class, which can lead to excessive memory allocation and CPU usage when processing multiple small frames.
Vulnerability Detail
The vulnerability arises from the LZ4FrameInputStream class allocating two new buffers of the maximum block size (up to 4 MiB) for every frame read. This behavior is problematic when processing many small frames, as it results in significant CPU and garbage collection overhead. For instance, reading 10,000 minimal empty frames can lead to approximately 8 MiB of memory allocation for every 11 bytes of input. This can severely impact application performance and availability, especially when handling attacker-controlled data.
How To Fix
Minimum fixed version
1.11.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating is not immediately possible, a temporary workaround is to limit the size of compressed input accepted from untrusted sources or to use single-frame mode when applicable. This can help mitigate the impact of the vulnerability.
Conclusion
In summary, CVE-2026-106450 affects the LZ4 Java library, leading to excessive memory allocation and CPU usage when processing small frames. It is crucial to update to version 1.11.4 or later to mitigate this vulnerability. Additionally, consider using Vulert to monitor your applications for similar vulnerabilities.
See every vulnerability recorded for at.yawk.lz4:lz4-java →
FAQ
CVE-2026-106450 is a vulnerability in the LZ4 Java library that causes excessive memory allocation and CPU usage when processing multiple small frames.
Applications using the affected LZ4FrameInputStream can experience significant performance degradation, especially when handling attacker-controlled data.
Versions of the LZ4 Java library prior to 1.11.4 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply check your pom.xml file on the Vulert playground without needing to sign up.
The CVSS score for this vulnerability is 5.3, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for at.yawk.lz4:lz4-java.
