fkie_cve-2026-106452

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2.

GHSA-4v53-57pg-c464 — yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

Affected: Maven: at.yawk.lz4:lz4-java, Maven: org.lz4:lz4-java

### Summary

`LZ4BlockInputStream` grows its compressed-input buffer to the attacker-controlled `compressedLen` value from the legacy `LZ4Block` stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap.

### Details

In `net.jpountz.lz4.LZ4BlockInputStream`, `refill()` validates that `compressedLen` is nonnegative but does not cap it before allocation:

```java case COMPRESSION_METHOD_LZ4: if (compressedBuffer.length < compressedLen) { compressedBuffer = new byte[Math.max(compressedLen, compressedBuffer.length * 3 / 2)]; } readFully(compressedBuffer, compressedLen); ```

The paired `LZ4BlockOutputStream` never emits such a block. If compression is not smaller than the original block, it writes the block as RAW:

```java if (compressedLength >= o) { compressMethod = COMPRESSION_METHOD_RAW; compressedLength = o; } else { compressMethod = COMPRESSION_METHOD_LZ4; } ```

Existing readers generally accept noncanonical LZ4-method blocks where `compressedLen >= originalLen`, but no canonical writer found produces them.

### Impact

Applications that pass attacker-controlled legacy `LZ4Block` streams to `LZ4BlockInputStream` can suffer heap exhaustion from a header-only input. The impact is availability-only and requires no valid compressed payload.

### Patch

As of lz4-java 1.11.2, lz4-java rejects lz4 blocks where the compressed length is larger than uncompressed. Readers would genera…

UBUNTU-CVE-2026-106452

Affected: Ubuntu:20.04:LTS: lz4-java, Ubuntu:22.04:LTS: lz4-java, Ubuntu:24.04:LTS: lz4-java, Ubuntu:26.04:LTS: lz4-java

(yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, ne ...)

Most recent entries from all

fkie_cve-2026-106452

GHSA-4v53-57pg-c464 — yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

UBUNTU-CVE-2026-106452