CVE-2026-106452

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-106452
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106452.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-106452
Aliases
Downstream
CGA (377)
CLEANSTART (6)
DEBIAN (1)
ECHO (1)
MINI (46)
UBUNTU (1)
Published
2026-10-06T19:52:37Z
Modified
2026-10-28T10:51:03Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header
Details

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-789"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106452.json"
}
References

Affected packages

Git / github.com/yawkat/lz4-java

Affected ranges

Type
GIT
Repo
https://github.com/yawkat/lz4-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0569f2e80433ac67f89616364a8f584ec3b20c45
Fixed
bb83dd16163cdb71231af06b0a5651881148a634
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.11.2"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "bb83dd16163cdb71231af06b0a5651881148a634"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.11.2",
            "range":  [
                {
                    "fixed":  "0569f2e80433ac67f89616364a8f584ec3b20c45"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.0.0
1.2.0
1.3.0
1.4.0
1.5.0
1.6.0
1.7.0
1.8.0
v1.*
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.11.0
v1.11.1
v1.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106452.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "312160357109987035876519786908756353372",
            "length":  118
        },
        "id":  "CVE-2026-106452-1f6b74b1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
        "target":  {
            "file":  "src/java/net/jpountz/lz4/LZ4BlockInputStream.java",
            "function":  "LZ4BlockInputStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "250876541478353597730421800254333754955",
                "322642627029926770499395933944989188656"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-106452-25c7129b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
        "target":  {
            "file":  "src/test/net/jpountz/lz4/LZ4BlockStreamingTest.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "77796662738169267367518277294788440531",
            "length":  390
        },
        "id":  "CVE-2026-106452-375ea1b7",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
        "target":  {
            "file":  "src/java/net/jpountz/lz4/LZ4BlockInputStream.java",
            "function":  "build"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "262744552222167289460485193270156524248",
                "99019703626287892174845179383633352655",
                "328765254740945180619541136194170913531",
                "91699964243279169505059978508387043075",
                "162415781861269316306740653409662386455",
                "313928137962480453627851029034362374163",
                "105551349044671662059757669474143872993",
                "91451813814609987357648670432938713239",
                "303099338451937625131270713732402172660",
                "63928952281216411379839092775560521940",
                "31569795508737674671135323420035073464",
                "33891866496264336759746926543191797215",
                "12888853129130893381904454636813419726",
                "224896659863091154078955267167588469683",
                "211644897688399802952348251654468991276",
                "99531990329661274855390217072558506712",
                "255146441327039118329568809555978650100",
                "232712803072367343137641010977727890782",
                "122683241605942471665619578829757180033",
                "31250144386168265559791508941903822299",
                "229637019999649054732698602555648714267",
                "17239295028701331367272218756732318981",
                "71161197418337917908197557569629084535",
                "37639139727297616447840596754372931916",
                "235411191872362139087079944547757729579",
                "149407903384868844216337979902281657215",
                "113038825568531340667642001974597557538",
                "176287991480652027612295225504729552448",
                "149565500051372829370049526405333382974",
                "25923867986618479980792501014419282866",
                "152242554741555355686087349791507509072",
                "202417373426698262360126623361926271567",
                "168564974070467782240206647783821581269",
                "245527372089023220188973196432666598119",
                "302170643398448901352695484198757694465",
                "175853685306757740841186564002737053182",
                "43743920575683017759539196488592490402",
                "42401641362719744514382981076881523063",
                "257291871096187818977930614754568141275",
                "145047466068836560939556645296228164167",
                "188530072495199599097907995963062271105",
                "76924246147334954351603729604816583288",
                "137157742368953913326267448816505141054",
                "124284180726607402335161790006471459280",
                "219054109106591842993722118884403234035",
                "75142863609677751587010442117032258965",
                "190569462625788815267453006843736011958",
                "132174926361816983882475285944266090542",
                "322320979784509514742335560935771601480",
                "299415275308394605051165302570250613310",
                "301672326314139859637058603137712105964",
                "203874501250351996864480479227728633338",
                "215387561976052755623224526722618751999",
                "153425061936917470497273672566232196907",
                "23503439304862065902767391077181504968",
                "188188463125885610842404105361120508847"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-106452-403f7726",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
        "target":  {
            "file":  "src/java/net/jpountz/lz4/LZ4BlockInputStream.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "281800316105270240084556598335205057510",
            "length":  331
        },
        "id":  "CVE-2026-106452-6530c97f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
        "target":  {
            "file":  "src/java/net/jpountz/lz4/LZ4BlockInputStream.java",
            "function":  "LZ4BlockInputStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "270964936310666911250399459636322167687",
            "length":  148
        },
        "id":  "CVE-2026-106452-76900f36",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
        "target":  {
            "file":  "src/java/net/jpountz/lz4/LZ4BlockInputStream.java",
            "function":  "LZ4BlockInputStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "241495630462549477293630264542416219155",
            "length":  184
        },
        "id":  "CVE-2026-106452-8de431f5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
        "target":  {
            "file":  "src/java/net/jpountz/lz4/LZ4BlockInputStream.java",
            "function":  "LZ4BlockInputStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "113901269862692672633615201492930089908",
            "length":  88
        },
        "id":  "CVE-2026-106452-e3205a55",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
        "target":  {
            "file":  "src/java/net/jpountz/lz4/LZ4BlockInputStream.java",
            "function":  "LZ4BlockInputStream"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "49234255171161153007909606295293014317",
            "length":  2499
        },
        "id":  "CVE-2026-106452-f51c73cf",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
        "target":  {
            "file":  "src/java/net/jpountz/lz4/LZ4BlockInputStream.java",
            "function":  "refill"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "73839952218046012685390943753425082468",
            "length":  96
        },
        "id":  "CVE-2026-106452-f949a5a4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
        "target":  {
            "file":  "src/java/net/jpountz/lz4/LZ4BlockInputStream.java",
            "function":  "LZ4BlockInputStream"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:51:03Z"