Is CVE-2026-106452 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106452 being exploited in the wild.

How severe is CVE-2026-106452?

Medium severity, with a CVSS score of 5.3, published 6 October 2026.

Which products and versions are affected?

at.yawk.lz4:lz4-java (Maven) <= 1.11.1, ECOSYSTEM:introduced=0,fixed=1.11.2; org.lz4:lz4-java (Maven) <= 1.8.1, ECOSYSTEM:introduced=0,last_affected=1.8.1; Yawkat LZ4 Java before 1.11.2.

How is CVE-2026-106452 attacked?

It is attacked over the network.

Am I affected by CVE-2026-106452?

Check whether you run at.yawk.lz4:lz4-java (Maven), org.lz4:lz4-java (Maven) or Yawkat LZ4 Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106452: yawkat LZ4 Java heap exhaustion in LZ4BlockInputStream

Q: Is there a fix for CVE-2026-106452?

Yes. at.yawk.lz4:lz4-java (Maven): upgrade to 1.11.2 or later. Until then: Use the Builder.withAcceptOversizedBlocks(boolean) option only for trusted inputs; by default, version 1.11.2 rejects blocks whose compressed length is greater than or equal to the original length, preventing the large allocations. [{"kind": "disclosed", "at": "2026-10-06"}, {"kind": "patched", "at": "2026-08-06", "note": "Fix released in version 1.11.2"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-106452 · Severity: medium · CVSS 5.3 · Published 2026-10-06

yawkat LZ4 Java is a compression library used by Java applications. A flaw in how the LZ4BlockInputStream class processes compressed data headers allows an attacker to supply a malformed file that tricks the application into allocating up to 2 GB of heap memory based on attacker-controlled values, causing the JVM to run out of memory and crash.

Technologies: at.yawk.lz4:lz4-java (Maven), org.lz4:lz4-java (Maven), Yawkat LZ4 Java. Vendors: Maven, Yawkat.

Quick answers

Is CVE-2026-106452 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106452 being exploited in the wild.
How severe is CVE-2026-106452?: Medium severity, with a CVSS score of 5.3, published 6 October 2026.
Which products and versions are affected?: at.yawk.lz4:lz4-java (Maven) <= 1.11.1, ECOSYSTEM:introduced=0,fixed=1.11.2; org.lz4:lz4-java (Maven) <= 1.8.1, ECOSYSTEM:introduced=0,last_affected=1.8.1; Yawkat LZ4 Java before 1.11.2.
Is there a fix for CVE-2026-106452?: Yes. at.yawk.lz4:lz4-java (Maven): upgrade to 1.11.2 or later. Until then: Use the Builder.withAcceptOversizedBlocks(boolean) option only for trusted inputs; by default, version 1.11.2 rejects blocks whose compressed length is greater than or equal to the original length, preventing the large allocations.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-06"}, {"kind": "patched", "at": "2026-08-06", "note": "Fix released in version 1.11.2"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106452 attacked?: It is attacked over the network.
Am I affected by CVE-2026-106452?: Check whether you run at.yawk.lz4:lz4-java (Maven), org.lz4:lz4-java (Maven) or Yawkat LZ4 Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

at.yawk.lz4:lz4-java (Maven): upgrade to 1.11.2 or later

# set at.yawk.lz4:lz4-java to 1.11.2 in your pom.xml or build.gradle

Use the Builder.withAcceptOversizedBlocks(boolean) option only for trusted inputs; by default, version 1.11.2 rejects blocks whose compressed length is greater than or equal to the original length, preventing the large allocations.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-06"}, {"kind": "patched", "at": "2026-08-06", "note": "Fix released in version 1.11.2"}]

Technical details

The LZ4BlockInputStream.refill() method validates that the compressedLen field in a legacy LZ4 block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data. An attacker can craft a header-only stream requesting a near-2 GiB allocation to exhaust JVM heap without providing actual payload, even though canonical LZ4 writers do not emit such blocks. This denial of service requires network access to send the malformed LZ4 stream.

Affected products

yawkat LZ4 Java before 1.11.2

Identifiers

CVE-2026-106452
GHSA-4v53-57pg-c464

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.