CVE-2026-106449: yawkat LZ4 Java StackOverflowError Due to Empty Block Recursion
Summary
CVE-2026-106449: When LZ4BlockInputStream is configured with stopOnEmptyBlock = false (the mode for reading concatenated block streams), it handles each empty block by calling refill() recursively. Affects at.yawk.lz4:lz4-java versions < 1.11.4. Fixed in 1.11.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The LZ4 Java library, specifically the at.yawk.lz4:lz4-java and org.lz4:lz4-java packages, is designed for high-performance compression and decompression of data. It is widely used in applications requiring efficient data storage and transmission. However, a specific configuration of the LZ4BlockInputStream can lead to a vulnerability when handling empty blocks, potentially causing a StackOverflowError.
Vulnerability Detail
The vulnerability arises in the LZ4BlockInputStream when configured with stopOnEmptyBlock set to false. In this mode, the stream handles empty blocks by recursively calling the refill method. If a stream contains a long sequence of empty blocks, this recursion can exhaust the thread stack, leading to a StackOverflowError. This error is not an IOException, which means that applications that only handle I/O errors may not catch it, resulting in unexpected application crashes.
How To Fix
Latest published version: 1.12.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update the package, a temporary workaround is to set stopOnEmptyBlock to true when creating the LZ4BlockInputStream. This can be done as follows:
LZ4BlockInputStream inputStream = LZ4BlockInputStream.newBuilder(yourInputStream) .withStopOnEmptyBlock(true) .build();
Conclusion
The vulnerability CVE-2026-106449 in the LZ4 Java library can lead to a StackOverflowError when processing empty blocks in a specific configuration. It is crucial to update to the patched version or implement the recommended workaround to ensure application stability.
See every vulnerability recorded for at.yawk.lz4:lz4-java →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
If left unaddressed, applications may crash due to StackOverflowError when processing streams with many empty blocks.
You can use Vulert, which monitors open-source vulnerabilities in real-time. You can check your application's pom.xml for vulnerabilities without needing to sign up.
No, this vulnerability does not lead to memory corruption; it only affects the availability of the application.
The default configuration for stopOnEmptyBlock is true, which prevents the vulnerability from occurring.
References
Related vulnerabilities
Recent vulnerabilities recorded for at.yawk.lz4:lz4-java.
