Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-106449: yawkat LZ4 Java can crash when processing many empty blocks
CVE-2026-106449 · published 12 days ago
Summary
The LZ4 compression library for Java (versions before 1.11.4) can run out of stack space if it receives a compressed file that contains many empty sections. This can cause the program to stop with a StackOverflow error. Upgrade the library to version 1.11.4 or later to avoid the crash.
What to do
- Update at.yawk.lz4:lz4-java to version 1.11.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | yawkat | lz4-java | < 1.11.4 |
| maven | – | at.yawk.lz4:lz4-java |
<= 1.11.3 Fix: upgrade to 1.11.4
|
| maven | – | org.lz4:lz4-java | <= 1.8.1 |
| Ubuntu:20.04:LTS | canonical | lz4-java | All versions |
| Debian:12 | debian | lz4-java | All versions |
| Maven | – | at.yawk.lz4:lz4-java |
< 1.11.4 Fix: upgrade to 1.11.4
|
Original advisory text
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-1064... Vendor Advisory
- https://github.com/advisories/GHSA-343h-94h5-c4wr
- https://nvd.nist.gov/vuln/detail/CVE-2026-106449 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-106449 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-106449 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-106449 Vendor Advisory
- https://github.com/yawkat/lz4-java Product
- https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr Third Party Advisory
- https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0...
- https://github.com/yawkat/lz4-java/releases/tag/v1.11.4
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-674Uncontrolled Recursion
Timeline
Published6 Oct 2026
Updated17 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-106449 · NVD
CVE-2026-106449 · MITRE
CVE-2026-106449 · OSV
GHSA-343h-94h5-c4wr · GHSA
UBUNTU-CVE-2026-106449 · OSV
DEBIAN-CVE-2026-106449 · OSV
GHSA-343h-94h5-c4wr · OSV
Track software like this
Free during beta