[ Vendor · 5 CVEs ]
yawkat
CVEs affecting yawkat published in the last 30 days, plus any yawkat CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-106450 | 6 Oct 2026 | CVSS 5.3 | yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputsyawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block… | Fix |
| CVE-2026-106451 | 6 Oct 2026 | CVSS 7.3 | yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local useryawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an… | Fix |
| CVE-2026-106452 | 6 Oct 2026 | CVSS 5.3 | yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream headeryawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen… | Fix |
| CVE-2026-106453 | 6 Oct 2026 | CVSS 5.3 | yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryErroryawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte… | Fix |
| CVE-2026-106449 | 6 Oct 2026 | CVSS 3.7 | yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowErroryawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false… | Fix |