Vulnerability-Lookup

CVE-2026-106449 (GCVE-0-2026-106449)

Vulnerability from cvelistv5 – Published: 2026-10-06 19:46 – Updated: 2026-10-07 16:28

Title

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

Summary

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 16:28 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/yawkat/lz4-java/security/advis…	x_refsource_CONFIRM
https://github.com/yawkat/lz4-java/commit/c8ebf97…	x_refsource_MISC
https://github.com/yawkat/lz4-java/releases/tag/v1.11.4	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
yawkat	lz4-java	Affected: < 1.11.4	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106449",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T16:28:27.534978Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T16:28:56.080Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lz4-java",
          "vendor": "yawkat",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread\u0027s stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T19:46:28.569Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"
        },
        {
          "name": "https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8"
        },
        {
          "name": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"
        }
      ],
      "source": {
        "advisory": "GHSA-343h-94h5-c4wr",
        "discovery": "UNKNOWN"
      },
      "title": "yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106449",
    "datePublished": "2026-10-06T19:46:28.569Z",
    "dateReserved": "2026-10-06T16:49:40.590Z",
    "dateUpdated": "2026-10-07T16:28:56.080Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-106449",
      "date": "2026-10-08",
      "epss": "0.00339",
      "percentile": "0.25225"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "lz4-java",
                "vendor": "yawkat",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.11.4"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread\u0027s stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4."
          }
        ],
        "id": "CVE-2026-106449",
        "lastModified": "2026-10-07T17:16:47.877",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-106449",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T16:28:27.534978Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-06T20:17:26.887",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-674"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-10-07T06:12:06+00:00",
      "cve": "CVE-2026-106449",
      "id": "CVE-2026-106449",
      "initial_release_date": "2026-10-06T19:46:28.569000+00:00",
      "product_status:known_affected": "13",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "org.lz4/lz4-java: lz4-java: Denial of Service via stack exhaustion from empty blocks",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106449.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-106449",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-07T16:28:27.534978Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-07T16:28:38.017Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "lz4-java",
              "vendor": "yawkat",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.11.4"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread\u0027s stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-674",
                  "description": "CWE-674: Uncontrolled Recursion",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-06T19:46:28.569Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"
            },
            {
              "name": "https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8"
            },
            {
              "name": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.4",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"
            }
          ],
          "source": {
            "advisory": "GHSA-343h-94h5-c4wr",
            "discovery": "UNKNOWN"
          },
          "title": "yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-106449",
        "datePublished": "2026-10-06T19:46:28.569Z",
        "dateReserved": "2026-10-06T16:49:40.590Z",
        "dateUpdated": "2026-10-07T16:28:56.080Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-106449

Vulnerability from fkie_nvd - Published: 2026-10-06 20:17 - Updated: 2026-10-07 17:16

Severity

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8
	security-advisories@github.com	https://github.com/yawkat/lz4-java/releases/tag/v1.11.4
	security-advisories@github.com	https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "lz4-java",
          "vendor": "yawkat",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.4"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread\u0027s stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4."
    }
  ],
  "id": "CVE-2026-106449",
  "lastModified": "2026-10-07T17:16:47.877",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-106449",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-07T16:28:27.534978Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-06T20:17:26.887",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-343H-94H5-C4WR

Vulnerability from github – Published: 2026-10-07 20:35 – Updated: 2026-10-07 20:35

Summary

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

Details

Summary

When LZ4BlockInputStream is configured with stopOnEmptyBlock = false (the mode for reading concatenated block streams), it handles each empty block by calling refill() recursively. A long run of empty blocks exhausts the thread stack and throws StackOverflowError out of read() or skip().

Details

In net.jpountz.lz4.LZ4BlockInputStream.refill():

if (originalLen == 0 && compressedLen == 0) {
  if (check != 0) {
    throw new IOException("Stream is corrupted");
  }
  if (!stopOnEmptyBlock) {
    refill();
  } else {
    finished = true;
  }
  return;
}

Each well-formed empty block is 21 bytes and adds one stack frame, with no limit on nesting depth. In local testing, around 10,000 to 100,000 consecutive empty blocks (about 210 KB to 2.1 MB, depending on JIT state and thread stack size) threw StackOverflowError. StackOverflowError is an Error, not an IOException, so callers that only handle I/O errors for corrupt input don't catch it.

Impact

Applications that decode attacker-controlled LZ4Block streams with LZ4BlockInputStream.newBuilder().withStopOnEmptyBlock(false) or the deprecated LZ4BlockInputStream(InputStream, boolean) constructor can have the decoding thread fail with StackOverflowError. The default configuration (stopOnEmptyBlock = true) is not affected. There is no memory corruption. Availability impact only.

Patch

Fixed in lz4-java 1.11.4. Empty blocks are now skipped in a loop instead of by recursion, so any number of consecutive empty blocks uses constant stack space.

For older versions, the workaround is to use the default stopOnEmptyBlock = true for untrusted input, or catch StackOverflowError around the read loop.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.11.3"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "at.yawk.lz4:lz4-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.lz4:lz4-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106449"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T20:35:46Z",
    "nvd_published_at": "2026-10-06T20:17:26Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nWhen `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated block streams), it handles each empty block by calling `refill()` recursively. A long run of empty blocks exhausts the thread stack and throws `StackOverflowError` out of `read()` or `skip()`.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream.refill()`:\n\n```java\nif (originalLen == 0 \u0026\u0026 compressedLen == 0) {\n  if (check != 0) {\n    throw new IOException(\"Stream is corrupted\");\n  }\n  if (!stopOnEmptyBlock) {\n    refill();\n  } else {\n    finished = true;\n  }\n  return;\n}\n```\n\nEach well-formed empty block is 21 bytes and adds one stack frame, with no limit on nesting depth. In local testing, around 10,000 to 100,000 consecutive empty blocks (about 210 KB to 2.1 MB, depending on JIT state and thread stack size) threw `StackOverflowError`. `StackOverflowError` is an `Error`, not an `IOException`, so callers that only handle I/O errors for corrupt input don\u0027t catch it.\n\n### Impact\n\nApplications that decode attacker-controlled `LZ4Block` streams with `LZ4BlockInputStream.newBuilder().withStopOnEmptyBlock(false)` or the deprecated `LZ4BlockInputStream(InputStream, boolean)` constructor can have the decoding thread fail with `StackOverflowError`. The default configuration (`stopOnEmptyBlock = true`) is not affected. There is no memory corruption. Availability impact only.\n\n### Patch\n\nFixed in lz4-java 1.11.4. Empty blocks are now skipped in a loop instead of by recursion, so any number of consecutive empty blocks uses constant stack space.\n\nFor older versions, the workaround is to use the default `stopOnEmptyBlock = true` for untrusted input, or catch `StackOverflowError` around the read loop.",
  "id": "GHSA-343h-94h5-c4wr",
  "modified": "2026-10-07T20:35:46Z",
  "published": "2026-10-07T20:35:46Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106449"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yawkat/lz4-java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError"
}

UBUNTU-CVE-2026-106449 (CVE-2026-106449)

Vulnerability from osv_ubuntu – Published: 2026-10-07 00:00 – Updated: 2026-10-07 00:00 – Source website

Details

(yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, ne ...)

Severity

3.7 (Low)


                    
                      CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-106449	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-106449	REPORT
	https://github.com/yawkat/lz4-java/security/advis…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "liblz4-java",
            "binary_version": "1.5.1-2"
          },
          {
            "binary_name": "liblz4-jni",
            "binary_version": "1.5.1-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "lz4-java",
        "purl": "pkg:deb/ubuntu/lz4-java@1.5.1-2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.1-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "liblz4-java",
            "binary_version": "1.5.1-3build1"
          },
          {
            "binary_name": "liblz4-jni",
            "binary_version": "1.5.1-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "lz4-java",
        "purl": "pkg:deb/ubuntu/lz4-java@1.5.1-3build1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.1-3build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "liblz4-java",
            "binary_version": "1.8.0-4build1"
          },
          {
            "binary_name": "liblz4-jni",
            "binary_version": "1.8.0-4build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "lz4-java",
        "purl": "pkg:deb/ubuntu/lz4-java@1.8.0-4build1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.0-3",
        "1.8.0-4",
        "1.8.0-4build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "liblz4-java",
            "binary_version": "1.8.0-4build2"
          },
          {
            "binary_name": "liblz4-jni",
            "binary_version": "1.8.0-4build2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "lz4-java",
        "purl": "pkg:deb/ubuntu/lz4-java@1.8.0-4build2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.0-4build1",
        "1.8.0-4build2"
      ]
    }
  ],
  "aliases": [],
  "details": "(yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, ne ...)",
  "id": "UBUNTU-CVE-2026-106449",
  "modified": "2026-10-07T00:00:00Z",
  "published": "2026-10-07T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-106449"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106449"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-106449"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-106449 (GCVE-0-2026-106449)

FKIE_CVE-2026-106449

GHSA-343H-94H5-C4WR

Summary

Details

Impact

Patch

UBUNTU-CVE-2026-106449 (CVE-2026-106449)

Tags

Sightings

Nomenclature

Related by attack behaviour