These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-106451 debrief: yawkat LZ4 Java vulnerable to native library replacement. The vulnerability allows local users to replace native library files, potentially leading to native code execution or library loading failure. Successful exploitation requires shared-directory permissions, host protections, and winning the race. Configurations using a system library, a private java.io.tmpdir, or Java-only i [truncated]
CVE-2026-106449: The yawkat LZ4 Java library has a vulnerability in LZ4BlockInputStream that causes a StackOverflowError when handling empty blocks with stopOnEmptyBlock=false. This occurs because the refill() method is called recursively for each empty block, leading to a potential denial of service. Defenders should assess exposure and prioritize verification and updates to prevent potential crashes and [truncated]
A vulnerability in the LZ4 Java library allows for a near-2 GiB allocation and potential JVM heap exhaustion when processing attacker-controlled legacy LZ4Block streams. This issue arises from the lack of validation for the compressed length value from the stream header in LZ4BlockInputStream, which can lead to large allocations. Defenders handling untrusted or attacker-controlled LZ4Block streams should [truncated]
A vulnerability in the yawkat LZ4 Java library allows for an OutOfMemoryError when decompressing a specially crafted input. The issue arises from the LZ4DecompressorWithLength class trusting the four-byte decompressed-length header before validating the compressed input, permitting an attacker-supplied input to request a large output size. This vulnerability can lead to application instability and potenti [truncated]
This CVE debrief discusses a vulnerability in the LZ4 Java library, specifically in the LZ4FrameInputStream class. The class allocates two new buffers of up to 4 MiB each every time it reads a frame header, which can lead to CPU and GC amplification from small inputs. This can cause performance issues and potentially lead to denial-of-service attacks.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T15:16:56.160Z and has not been modified since then. The vulnerability in the LZ4 Java library's JNI-backed XXHash implementations could lead to fatal JVM termination. Defenders should verify their Java application inventories, identify those at risk, and apply the patch in version 1.11.1. Monitor [truncated]