CVE-2026-106453 yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError
Attackers can cause a denial of service by sending small inputs that trigger excessive memory allocation in the LZ4 decompressor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106453?
CVE-2026-106453 is a medium-severity denial of service vulnerability in yawkat lz4-java, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.
Weakness: CWE-789
Which versions are affected by CVE-2026-106453?
4 open source packages ship an affected version, including at.yawk.lz4:lz4-java and org.lz4:lz4-java.
| Package | Affected | Fixed in |
|---|---|---|
at.yawk.lz4:lz4-java Maven | All versions | 1.11.2 |
at.yawk.lz4:lz4-java Maven | All versions | 1.11.2 |
org.lz4:lz4-java Maven | All versions to 1.8.1 | None |
org.lz4:lz4-java Maven | All versions to 1.8.1 | None |
How do I fix CVE-2026-106453?
Upgrade at.yawk.lz4:lz4-java to 1.11.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-106453 being exploited?
There is no known exploitation of CVE-2026-106453 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-FE65941, CLEANSTART-2026-JO59370, CLEANSTART-2026-PK52336, CLEANSTART-2026-PM70548, CLEANSTART-2026-TG86788, CLEANSTART-2026-VZ71675 and 51 more.