CVE-2026-106453: Yawkat LZ4-Java

Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days.

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.

Affected products

• Yawkat LZ4-Java: before 1.11.2 (fixed in 1.11.2)

Published 2026-10-06. Last modified 2026-10-07.