CVE-2026-106451: yawkat LZ4 Java Native Library File Replacement Vulnerability
Summary
CVE-2026-106451: When no system-installed liblz4-java is found, net.jpountz.util.Native.load() extracts the bundled native library to java.io.tmpdir and loads it with System.load. Affects at.yawk.lz4:lz4-java versions < 1.11.4. Fixed in 1.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The LZ4 Java library, maintained by yawkat, is a high-performance compression library designed for fast data compression and decompression. It is widely used in applications that require efficient data handling. However, a vulnerability was discovered in the way the library handles native library extraction, making it susceptible to local file replacement attacks.
Vulnerability Detail
The vulnerability arises when the LZ4 Java library attempts to load its native library from a temporary directory. If the system-installed version of 'liblz4-java' is not found, the library extracts a bundled native library to 'java.io.tmpdir'. The extraction path can be predicted, and the library file is opened without exclusive creation. This allows another local user to create a file at the same path before the library is loaded, potentially executing malicious code. The issue was introduced in version 1.7.0 and can lead to code execution if the attacker can write to the same temporary directory as the victim process.
How To Fix
Minimum fixed version
1.11.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, set 'java.io.tmpdir' to a directory that is writable only by the application user. This can be done by adding the following JVM argument when starting your application:
-Djava.io.tmpdir=/path/to/private/tmpdir
Conclusion
The LZ4 Java library vulnerability CVE-2026-106451 poses a significant risk due to its potential for local file replacement attacks. It is crucial to update to the patched version 1.11.4 or implement the suggested workaround to mitigate the risk.
See every vulnerability recorded for at.yawk.lz4:lz4-java →
FAQ
CVE-2026-106451 is a vulnerability in the LZ4 Java library that allows local users to replace a native library file in a shared temporary directory, potentially leading to code execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 7.3, indicating a high severity level.
If you cannot update the library, consider using the provided workaround by setting 'java.io.tmpdir' to a private directory writable only by the application user.
If exploited, this vulnerability can allow an attacker to execute arbitrary code within the context of the victim's Java application, leading to data breaches or system compromise.
References
Related vulnerabilities
Recent vulnerabilities recorded for at.yawk.lz4:lz4-java.
