CVE-2026-106449

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-106449
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106449.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-106449
Aliases
Downstream
Published
2026-10-06T19:46:28Z
Modified
2026-10-07T13:20:59Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError
Details

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106449.json"
}
References

Affected packages

Git / github.com/yawkat/lz4-java

Affected ranges

Type
GIT
Repo
https://github.com/yawkat/lz4-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4af910bc99c2f021f0cd56f6ca7f7600f4dda4a0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.11.4"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.0.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
1.8.0
v1.*
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106449.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "214388248717931299923900274857980516335",
                "65683750676527707633078656054170255344",
                "118287103178809004985414128698616388518",
                "300637533127697537612035724601996989858",
                "266104950906479238541857316988367999351",
                "134728242984367791732063153507024217733",
                "42467283072344628588104348871426341262",
                "120304495577461616964057978192822068584",
                "241948005302004834692069803815921267754",
                "300772486054080233650511326870296722448",
                "199868925319664771762581168079999457280",
                "199852464834928763731943148423675137228",
                "5780372513503982885265799084234661786",
                "185404016909992595827221147264550945351",
                "26652769941461710058292728882523053930",
                "13075325095172813375000686650282311601",
                "269691371974919895669012905319974831748",
                "68119049062416810164251849865742483758",
                "118762952372007463797917670866819281951",
                "269126750384551754583012292750271610628",
                "173611378178514036441531353351102857178"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-106449-51af3d82",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/yawkat/lz4-java/commit/4af910bc99c2f021f0cd56f6ca7f7600f4dda4a0",
        "target": {
            "file": "src/test/net/jpountz/lz4/LZ4BlockStreamingTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "20082239809390668882048052815584052754",
            "length": 678
        },
        "id": "CVE-2026-106449-e30894f2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/yawkat/lz4-java/commit/4af910bc99c2f021f0cd56f6ca7f7600f4dda4a0",
        "target": {
            "file": "src/test/net/jpountz/lz4/LZ4BlockStreamingTest.java",
            "function": "testAvailableAfterEmptyBlock"
        }
    }
]
vanir_signatures_modified 
"2026-10-07T13:20:59Z"