Yawkat LZ4 Java contains a flaw in LZ4BlockInputStream when the stopOnEmptyBlock flag is disabled. In this configuration the stream calls the refill method recursively for each empty LZ4 block. A malicious stream that contains many consecutive empty blocks will exhaust the Java thread’s call stack and raise a StackOverflowError, causing the application that processes the stream to crash. The bug does not corrupt memory or disclose information but results in a denial‑of‑service condition.

Any use of the yawkat lz4‑java library before version 1.11.4 is affected when the LZ4BlockInputStream is constructed with the stopOnEmptyBlock option set to false. Versions 1.11.4 and later contain the patch that removes the recursive refill and limits the recursion depth. Applications that rely on the library for decoding compressed data should verify the library version and configuration.

The CVSS score of 3.7 classifies this issue as low severity, and the EPSS score is unavailable, suggesting the likelihood of widespread exploitation is currently unknown. Because the vulnerability is triggered by an attacker‑controlled compressed stream and does not require elevated privileges, an attacker with the ability to supply data to a Java program that uses the vulnerable library can easily enact the denial‑of‑service attack. The bug is listed as not in the CISA KEV catalog, indicating no known widespread exploitation. Defensive measures should treat it as a potential low‑impact DoS threat that could compound with other weaknesses.