Log in Start free

Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M

CVE-2026-106449yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

Low 3.7

In plain English

A low-severity security flaw in lz4-java from yawkat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 63.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12lz4-javano fix listedDEBIAN-CVE-2026-106449
Debian:13lz4-javano fix listedDEBIAN-CVE-2026-106449
Debian:14lz4-javano fix listedDEBIAN-CVE-2026-106449
Mavenat.yawk.lz4:lz4-java1.11.4GHSA-343h-94h5-c4wr
Mavenorg.lz4:lz4-javano fix listedGHSA-343h-94h5-c4wr
Ubuntu:22.04:LTSlz4-javano fix listedUBUNTU-CVE-2026-106449
Ubuntu:24.04:LTSlz4-javano fix listedUBUNTU-CVE-2026-106449
Ubuntu:26.04:LTSlz4-javano fix listedUBUNTU-CVE-2026-106449
Ubuntu:26.10lz4-javano fix listedUBUNTU-CVE-2026-106449

Affected products (as reported)

VendorProductVersions
yawkat lz4-java < 1.11.4

Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

References