CVE-2026-106452: yawkat LZ4 Java Buffer Allocation Vulnerability
Summary
CVE-2026-106452: yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header. Affects at.yawk.lz4:lz4-java versions < 1.11.2. Fixed in 1.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The LZ4 Java library, specifically the at.yawk.lz4:lz4-java and org.lz4:lz4-java packages, is designed for high-performance compression and decompression of data. It is widely used in applications requiring efficient data storage and transmission. However, a vulnerability has been identified in the LZ4BlockInputStream class, which can lead to severe memory allocation issues when processing attacker-controlled input streams.
Vulnerability Detail
The vulnerability arises from the LZ4BlockInputStream's method of allocating a compressed-input buffer based on an unvalidated length derived from the stream header. Specifically, the refill() method checks that the compressed length is nonnegative but does not impose a limit on its size. This oversight allows an attacker to craft a header-only input that requests a near-2 GiB allocation, potentially exhausting the Java Virtual Machine (JVM) heap and leading to denial of service (DoS). The vulnerability is classified as having a CVSS score of 5.3, indicating a moderate severity level.
How To Fix
Latest published version: 1.12.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update to the patched version, you can use the new acceptOversizedBlocks flag to restore the old behavior temporarily. However, be aware that this reintroduces the denial of service vector. Example usage:
LZ4BlockInputStream inputStream = new
LZ4BlockInputStream(..., acceptOversizedBlocks=true);
Conclusion
The vulnerability CVE-2026-106452 in the LZ4 Java library poses a risk of denial of service due to improper handling of compressed input lengths. It is crucial to update to the patched version to mitigate this risk. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for at.yawk.lz4:lz4-java →
FAQ
CVE-2026-106452 is a vulnerability in the LZ4 Java library that allows for excessive memory allocation based on attacker-controlled input, potentially leading to denial of service.
Versions of at.yawk.lz4:lz4-java up to 1.11.1 and org.lz4:lz4-java up to 1.8.1 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
If an immediate update is not possible, consider using the acceptOversizedBlocks flag to temporarily restore old behavior, but be cautious as this reintroduces the vulnerability.
The vulnerability has a CVSS score of 5.3, indicating a moderate severity level that could lead to denial of service.
References
Related vulnerabilities
Recent vulnerabilities recorded for at.yawk.lz4:lz4-java.
