cyfenced.com →

[ CVE-2026-106453 · Published 6 Oct 2026 ]

yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError

CVSS 5.3 EPSS <1%Fix available

[ Description ]Official description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.

[ Fixes ]Fixes and patches

  • at.yawk.lz4:lz4-java 1.11.2Fixed version · GitHub Advisories · maven package at.yawk.lz4:lz4-java: upgrade to 1.11.2 or later (affected <= 1.11.1)

[ Packages ]Affected open-source packages

[ References ]References