Vulnerability-Lookup

CVE-2026-106452 (GCVE-0-2026-106452)

Vulnerability from cvelistv5 – Published: 2026-10-06 19:52 – Updated: 2026-10-07 10:45

Title

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

Summary

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-07 10:45 UTC

CWE

CWE-789 - Memory Allocation with Excessive Size Value

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7580 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/yawkat/lz4-java/security/advis…	x_refsource_CONFIRM
https://github.com/yawkat/lz4-java/commit/bb83dd1…	x_refsource_MISC
https://github.com/yawkat/lz4-java/releases/tag/v1.11.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
yawkat	lz4-java	Affected: < 1.11.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T10:45:08.750360Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T10:45:18.010Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "lz4-java",
          "vendor": "yawkat",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "CWE-789: Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T19:52:37.818Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"
        },
        {
          "name": "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634"
        },
        {
          "name": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"
        }
      ],
      "source": {
        "advisory": "GHSA-4v53-57pg-c464",
        "discovery": "UNKNOWN"
      },
      "title": "yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106452",
    "datePublished": "2026-10-06T19:52:37.818Z",
    "dateReserved": "2026-10-06T16:49:40.591Z",
    "dateUpdated": "2026-10-07T10:45:18.010Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-106452",
      "date": "2026-10-08",
      "epss": "0.00371",
      "percentile": "0.28981"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "lz4-java",
                "vendor": "yawkat",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 1.11.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2."
          }
        ],
        "id": "CVE-2026-106452",
        "lastModified": "2026-10-07T13:58:29.527",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-106452",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T10:45:08.750360Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-06T20:17:27.317",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-789"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-07T06:05:42+00:00",
      "cve": "CVE-2026-106452",
      "id": "CVE-2026-106452",
      "initial_release_date": "2026-10-06T19:52:37.818000+00:00",
      "product_status:known_affected": "13",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "org.lz4/lz4-java: lz4-java: Denial of Service via excessive memory allocation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106452.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-106452",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-07T10:45:08.750360Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-07T10:45:14.297Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "lz4-java",
              "vendor": "yawkat",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 1.11.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-789",
                  "description": "CWE-789: Memory Allocation with Excessive Size Value",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-06T19:52:37.818Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"
            },
            {
              "name": "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634"
            },
            {
              "name": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"
            }
          ],
          "source": {
            "advisory": "GHSA-4v53-57pg-c464",
            "discovery": "UNKNOWN"
          },
          "title": "yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-106452",
        "datePublished": "2026-10-06T19:52:37.818Z",
        "dateReserved": "2026-10-06T16:49:40.591Z",
        "dateUpdated": "2026-10-07T10:45:18.010Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-106452

Vulnerability from fkie_nvd - Published: 2026-10-06 20:17 - Updated: 2026-10-07 13:58

Severity

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634
	security-advisories@github.com	https://github.com/yawkat/lz4-java/releases/tag/v1.11.2
	security-advisories@github.com	https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "lz4-java",
          "vendor": "yawkat",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.11.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2."
    }
  ],
  "id": "CVE-2026-106452",
  "lastModified": "2026-10-07T13:58:29.527",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-106452",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-07T10:45:08.750360Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-06T20:17:27.317",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-4V53-57PG-C464

Vulnerability from github – Published: 2026-10-07 16:17 – Updated: 2026-10-07 16:17

Summary

yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

Details

Summary

LZ4BlockInputStream grows its compressed-input buffer to the attacker-controlled compressedLen value from the legacy LZ4Block stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap.

Details

In net.jpountz.lz4.LZ4BlockInputStream, refill() validates that compressedLen is nonnegative but does not cap it before allocation:

case COMPRESSION_METHOD_LZ4:
  if (compressedBuffer.length < compressedLen) {
    compressedBuffer = new byte[Math.max(compressedLen, compressedBuffer.length * 3 / 2)];
  }
  readFully(compressedBuffer, compressedLen);

The paired LZ4BlockOutputStream never emits such a block. If compression is not smaller than the original block, it writes the block as RAW:

if (compressedLength >= o) {
  compressMethod = COMPRESSION_METHOD_RAW;
  compressedLength = o;
} else {
  compressMethod = COMPRESSION_METHOD_LZ4;
}

Existing readers generally accept noncanonical LZ4-method blocks where compressedLen >= originalLen, but no canonical writer found produces them.

Impact

Applications that pass attacker-controlled legacy LZ4Block streams to LZ4BlockInputStream can suffer heap exhaustion from a header-only input. The impact is availability-only and requires no valid compressed payload.

Patch

As of lz4-java 1.11.2, lz4-java rejects lz4 blocks where the compressed length is larger than uncompressed. Readers would generally emit these as raw blocks instead. You can use the new acceptOversizedBlocks flag to restore the old behavior, but this reintroduces the DoS vector.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.11.1"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "at.yawk.lz4:lz4-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.lz4:lz4-java"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.8.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-106452"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-07T16:17:50Z",
    "nvd_published_at": "2026-10-06T20:17:27Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\n`LZ4BlockInputStream` grows its compressed-input buffer to the attacker-controlled `compressedLen` value from the legacy `LZ4Block` stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream`, `refill()` validates that `compressedLen` is nonnegative but does not cap it before allocation:\n\n```java\ncase COMPRESSION_METHOD_LZ4:\n  if (compressedBuffer.length \u003c compressedLen) {\n    compressedBuffer = new byte[Math.max(compressedLen, compressedBuffer.length * 3 / 2)];\n  }\n  readFully(compressedBuffer, compressedLen);\n```\n\nThe paired `LZ4BlockOutputStream` never emits such a block. If compression is not smaller than the original block, it writes the block as RAW:\n\n```java\nif (compressedLength \u003e= o) {\n  compressMethod = COMPRESSION_METHOD_RAW;\n  compressedLength = o;\n} else {\n  compressMethod = COMPRESSION_METHOD_LZ4;\n}\n```\n\nExisting readers generally accept noncanonical LZ4-method blocks where `compressedLen \u003e= originalLen`, but no canonical writer found produces them.\n\n### Impact\n\nApplications that pass attacker-controlled legacy `LZ4Block` streams to `LZ4BlockInputStream` can suffer heap exhaustion from a header-only input. The impact is availability-only and requires no valid compressed payload.\n\n### Patch\n\nAs of lz4-java 1.11.2, lz4-java rejects lz4 blocks where the compressed length is larger than uncompressed. Readers would generally emit these as raw blocks instead. You can use the new `acceptOversizedBlocks` flag to restore the old behavior, but this reintroduces the DoS vector.",
  "id": "GHSA-4v53-57pg-c464",
  "modified": "2026-10-07T16:17:51Z",
  "published": "2026-10-07T16:17:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106452"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/yawkat/lz4-java"
    },
    {
      "type": "WEB",
      "url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header"
}

UBUNTU-CVE-2026-106452 (CVE-2026-106452)

Vulnerability from osv_ubuntu – Published: 2026-10-07 00:00 – Updated: 2026-10-07 00:00 – Source website

Details

(yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, ne ...)

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-106452	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-106452	REPORT
	https://github.com/yawkat/lz4-java/security/advis…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "liblz4-java",
            "binary_version": "1.5.1-2"
          },
          {
            "binary_name": "liblz4-jni",
            "binary_version": "1.5.1-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "lz4-java",
        "purl": "pkg:deb/ubuntu/lz4-java@1.5.1-2?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.1-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "liblz4-java",
            "binary_version": "1.5.1-3build1"
          },
          {
            "binary_name": "liblz4-jni",
            "binary_version": "1.5.1-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "lz4-java",
        "purl": "pkg:deb/ubuntu/lz4-java@1.5.1-3build1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.5.1-3build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "liblz4-java",
            "binary_version": "1.8.0-4build1"
          },
          {
            "binary_name": "liblz4-jni",
            "binary_version": "1.8.0-4build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "lz4-java",
        "purl": "pkg:deb/ubuntu/lz4-java@1.8.0-4build1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.0-3",
        "1.8.0-4",
        "1.8.0-4build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "liblz4-java",
            "binary_version": "1.8.0-4build2"
          },
          {
            "binary_name": "liblz4-jni",
            "binary_version": "1.8.0-4build2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "lz4-java",
        "purl": "pkg:deb/ubuntu/lz4-java@1.8.0-4build2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.8.0-4build1",
        "1.8.0-4build2"
      ]
    }
  ],
  "aliases": [],
  "details": "(yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, ne ...)",
  "id": "UBUNTU-CVE-2026-106452",
  "modified": "2026-10-07T00:00:00Z",
  "published": "2026-10-07T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-106452"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106452"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-106452"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-106452 (GCVE-0-2026-106452)

FKIE_CVE-2026-106452

GHSA-4V53-57PG-C464

Summary

Details

Impact

Patch

UBUNTU-CVE-2026-106452 (CVE-2026-106452)

Tags

Sightings

Nomenclature

Related by attack behaviour