Low severity · published Oct 6, 2026
CVE-2026-106449
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
3.7
CVSS
0.4%
EPSS
No
On KEV
Description
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LZ
lz4-java · yawkat
< 1.11.4 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106449
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106449
x_refsource_CONFIRM
https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr
x_refsource_MISC
https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8
x_refsource_MISC
https://github.com/yawkat/lz4-java/releases/tag/v1.11.4
More from lz4-java
8.2
CVE-2025-66566
yawkat LZ4 Java has a possible information leak in Java safe decompressor
7.3
CVE-2026-106451
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
6.5
CVE-2026-59949
yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash JNI (StreamingXXHash32JNI / StreamingXXHash64JNI)
5.3
CVE-2026-106453
yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError
5.3
CVE-2026-106452
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header