yawkat lz4-java

• CVE-2026-106453 Medium 5.3 yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError 0.4%
• CVE-2026-106452 Medium 5.3 yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header 0.5%
• CVE-2026-106451 High 7.3 yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user 0.1%
• CVE-2026-106450 Medium 5.3 yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs 0.5%
• CVE-2026-106449 Low 3.7 yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError 0.4%
• CVE-2026-59949 Medium 6.5 yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash JNI (StreamingXXHash32JNI / StreamingXXHash64JNI) 0.5%
• CVE-2025-66566 High 8.2 yawkat LZ4 Java has a possible information leak in Java safe decompressor 0.6%