CVE-2026-106452 yawkat CVE debrief

Who should care

Defenders handling untrusted or attacker-controlled LZ4Block streams, particularly in systems using the LZ4 Java library, should assess exposure and prioritize verification and updates. This includes reviewing compensating controls, monitoring for potential heap exhaustion, and adjusting JVM settings as needed. The vulnerability is particularly concerning for defenders who handle untrusted streams, as it can lead to large allocations and potential heap

Why it matters

A vulnerability in the LZ4 Java library allows for a near-2 GiB allocation and potential JVM heap exhaustion when processing attacker-controlled legacy LZ4Block streams. Defenders handling untrusted streams should assess exposure and prioritize verification and updates.

• Potential JVM heap exhaustion via large allocation
• Verification of affected systems and updates required
• Monitoring for heap exhaustion and adjusting JVM settings

Technical summary

The LZ4BlockInputStream class in the LZ4 Java library does not validate the compressed length value from the stream header, allowing for a large allocation and potential heap exhaustion. This vulnerability can be triggered by a header-only input, leading to potential heap exhaustion. The issue arises from the lack of validation for the compressed length value, which can lead to large allocations. The vulnerability is particularly concerning because it can be triggered by a header-only input, leading to potential heap exhaustion.

Defensive priority

Defenders should prioritize verifying and updating affected systems, particularly those handling untrusted or attacker-controlled LZ4Block streams.

Recommended defensive actions

• Verify and update affected systems to version 1.11.2 or later
• Restrict access to untrusted or attacker-controlled LZ4Block streams
• Monitor for potential heap exhaustion and adjust JVM settings as needed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by the lack of validation for the compressed length value from the stream header in LZ4BlockInputStream. This can lead to a large allocation and potential heap exhaustion. The issue is exacerbated by the fact that existing readers generally accept noncanonical LZ4-method blocks where compressedLen >= originalLen, but no canonical writer found produces them. The vulnerability allows for a near-2 GiB allocation, which can exhaust the JVM heap.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.