yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

[ Description ]Official description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.

[ Fixes ]Fixes and patches

• at.yawk.lz4:lz4-java 1.11.4Fixed version · GitHub Advisories · maven package at.yawk.lz4:lz4-java: upgrade to 1.11.4 or later (affected <= 1.11.3)

[ Advisories ]Government CERT advisories

• BSI CERT-Bund18 Oct 2026WID-SEC-2026-4013

  DBeaver: Multiple vulnerabilities Translated from German

  CVE-2026-106449CVE-2026-106450CVE-2026-106451

[ Packages ]Affected open-source packages

• at.yawk.lz4:lz4-java mavenAffected <= 1.11.3 · fixed in 1.11.4 · GHSA-343h-94h5-c4wr
• org.lz4:lz4-java mavenAffected <= 1.8.1 · GHSA-343h-94h5-c4wr

[ References ]References

• github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8
• github.com/yawkat/lz4-java/releases/tag/v1.11.4
• github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr