GHSA-GM45-99XC-R7WV
Vulnerability from github – Published: 2026-10-07 20:35 – Updated: 2026-10-07 20:35Summary
LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 input bytes.
Details
In net.jpountz.lz4.LZ4FrameInputStream.readHeader():
maxBlockSize = frameInfo.getBD().getBlockMaximumSize();
compressedBuffer = new byte[maxBlockSize]; // Reused during different compressions
rawBuffer = new byte[maxBlockSize];
buffer = ByteBuffer.wrap(rawBuffer);
This runs for every frame, and the previous frame's arrays are never reused. A valid 11-byte frame consists of the magic number, FLG 0x60, BD 0x70 (4 MiB blocks), the header checksum, and an immediate end mark. It carries no data, yet triggers the full 8 MiB allocation. new LZ4FrameInputStream(in) reads concatenated frames by default.
In local measurements on JDK 25, 10,000 such frames (110 KB of input) took about 8 seconds of CPU to read, roughly 70 seconds per MiB of input. This was similar under G1, Parallel, Serial and ZGC. A legitimate stream costs orders of magnitude less per input byte.
Impact
Applications that decode attacker-controlled LZ4 frame data with LZ4FrameInputStream can be made to spend large amounts of CPU and GC time relative to the input size. Live heap stays bounded at about 8 MiB and the stream produces no output, so decompressed-size limits do not help. Cost grows linearly with input size, so the practical limit is the compressed input size the application accepts. Availability impact only.
Applications using readSingleFrame = true perform only one allocation and are not affected.
Patch
Fixed in lz4-java 1.11.4. LZ4FrameInputStream now allocates its block buffers only when a block needs them and reuses them across frames, never shrinking them. The content checksum hash and the skippable-frame skip buffer are also reused instead of being created for every frame. Decompression is limited to the current frame's maximum block size.
For older versions, the workaround is to limit the compressed input size accepted from untrusted sources, or use single-frame mode where that is sufficient.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.11.3"
},
"package": {
"ecosystem": "Maven",
"name": "at.yawk.lz4:lz4-java"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.lz4:lz4-java"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.8.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-106450"
],
"database_specific": {
"cwe_ids": [
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-07T20:35:40Z",
"nvd_published_at": "2026-10-06T20:17:27Z",
"severity": "MODERATE"
},
"details": "### Summary\n\n`LZ4FrameInputStream` allocates two new buffers of the frame\u0027s maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 input bytes.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4FrameInputStream.readHeader()`:\n\n```java\nmaxBlockSize = frameInfo.getBD().getBlockMaximumSize();\ncompressedBuffer = new byte[maxBlockSize]; // Reused during different compressions\nrawBuffer = new byte[maxBlockSize];\nbuffer = ByteBuffer.wrap(rawBuffer);\n```\n\nThis runs for every frame, and the previous frame\u0027s arrays are never reused. A valid 11-byte frame consists of the magic number, FLG `0x60`, BD `0x70` (4 MiB blocks), the header checksum, and an immediate end mark. It carries no data, yet triggers the full 8 MiB allocation. `new LZ4FrameInputStream(in)` reads concatenated frames by default.\n\nIn local measurements on JDK 25, 10,000 such frames (110 KB of input) took about 8 seconds of CPU to read, roughly 70 seconds per MiB of input. This was similar under G1, Parallel, Serial and ZGC. A legitimate stream costs orders of magnitude less per input byte.\n\n### Impact\n\nApplications that decode attacker-controlled LZ4 frame data with `LZ4FrameInputStream` can be made to spend large amounts of CPU and GC time relative to the input size. Live heap stays bounded at about 8 MiB and the stream produces no output, so decompressed-size limits do not help. Cost grows linearly with input size, so the practical limit is the compressed input size the application accepts. Availability impact only.\n\nApplications using `readSingleFrame = true` perform only one allocation and are not affected.\n\n### Patch\n\nFixed in lz4-java 1.11.4. `LZ4FrameInputStream` now allocates its block buffers only when a block needs them and reuses them across frames, never shrinking them. The content checksum hash and the skippable-frame skip buffer are also reused instead of being created for every frame. Decompression is limited to the current frame\u0027s maximum block size.\n\nFor older versions, the workaround is to limit the compressed input size accepted from untrusted sources, or use single-frame mode where that is sufficient.",
"id": "GHSA-gm45-99xc-r7wv",
"modified": "2026-10-07T20:35:40Z",
"published": "2026-10-07T20:35:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106450"
},
{
"type": "WEB",
"url": "https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283"
},
{
"type": "PACKAGE",
"url": "https://github.com/yawkat/lz4-java"
},
{
"type": "WEB",
"url": "https://github.com/yawkat/lz4-java/releases/tag/v1.11.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.