Description
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.
Published: 2026-10-06
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via CPU and memory exhaustion
Action: Patch Now
AI Analysis

Impact

The vulnerability arises when LZ4FrameInputStream allocates two 4 MiB buffers per maximum‑block‑size frame header, causing amplification. Attacker‑controlled streams full of tiny empty frames can trigger about 8 MiB of allocation for every 11 bytes of input, leading to elevated CPU and garbage‑collection activity with no decompressed data produced.

Affected Systems

The issue affects the yawkat lz4‑java library versions prior to 1.11.4. Users relying on that library, especially in environments that enable concatenated‑frame mode, are susceptible.

Risk and Exploitability

Based on the description, it is inferred that an attacker can supply a crafted stream from an untrusted or nearby source to trigger the amplification. The CVSS score is 5.3, indicating a moderate impact. With no EPSS score available and the vulnerability not listed in CISA KEV, exploitation is possible especially when concatenated‑frame mode is used. The effect is primarily denial of service via excessive CPU and memory consumption; there is no evidence of code execution or data disclosure.

Generated by OpenCVE AI on October 7, 2026 at 01:14 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to v1.11.4 or later
  • Disable concatenated‑frame mode if not required, or validate input before feeding it to LZ4FrameInputStream
  • Monitor system for abnormal CPU and GC spikes and enforce limits on data ingest

Generated by OpenCVE AI on October 7, 2026 at 01:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-gm45-99xc-r7wv yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs
History

Fri, 09 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 07 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
First Time appeared Yawkat
Yawkat lz4-java
Vendors & Products Yawkat
Yawkat lz4-java

Tue, 06 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Description yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.
Title yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Yawkat Lz4-java
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-09T01:44:37.343Z

Reserved: 2026-10-06T16:49:40.591Z

Link: CVE-2026-106450

cve-icon Vulnrichment

Updated: 2026-10-09T01:44:33.103Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T20:17:27.037

Modified: 2026-10-09T02:16:59.843

Link: CVE-2026-106450

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T19:48:40Z

Links: CVE-2026-106450 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T01:15:09Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling