CVE-2026-106449: yawkat lz4-java Uncontrolled Recursion

CVSS: 3.7v3.1LowAwaiting analysis

AliasesUBUNTU-CVE-2026-106449DEBIAN-CVE-2026-106449CGA-23vr-75wf-pvf2+385 more

Published 06-10-2026Last modified 07-10-2026

Vulnerability summary

CVE-2026-106449 is a low (CVSS 3.7) Uncontrolled Recursion vulnerability in yawkat lz4-java. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 25.8% of scored vulnerabilities.

Overall risk

15/100

0100

Low · default modelHow is this calculated?

CVSS score

3.7/10

010

Low · v3.1 (CVE.org)

EPSS score

0.34%

0%100%

Low · Change unavailable

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

06-10-2026
PublishedVulnerability first disclosed.
07-10-2026
Last modifiedVulnerability information updated.

Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.

CVSS metrics

7 scores · 7 sources · 1 version

v3.13.7

EPSS trend

Probability

0.34%

Chance of exploitation in the next 30 days

Percentile

26%

Versus all other CVEs

30-day change

Change unavailable

07-10-202619-10-2026

EPSS score

0.34%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected systems

Chainguard164 products

akhq< 0.28.0-r14
apache-hop< 2.19.0-r7
apache-hop-fips< 2.19.0-r5
apache-nifi-2.11< 2.11.0-r11
apache-nifi-2.12< 2.12.0-r5

apache-polarisAll versions (No fix recorded) | < 1.8.0-r5
apache-polaris-fips< 1.7.0-r5
apache-pulsar-4.0< 4.0.14-r1
apache-pulsar-4.2< 4.2.5-r1
apache-pulsar-fips-4.0< 4.0.14-r1
apache-pulsar-fips-4.2< 4.2.5-r1
apicurio-registry-fips< 3.3.3-r4
automq< 1.7.4-r2
automq-fips< 1.7.4-r2
cassandra-4.0All versions (No fix recorded) | < 4.0.21-r4
cassandra-4.1All versions (No fix recorded) | < 4.1.12-r4
cassandra-5.0< 5.0.9-r12
cassandra-fips-4.0All versions (No fix recorded) | < 4.0.21-r5
cassandra-fips-4.1All versions (No fix recorded) | < 4.1.12-r5
cassandra-fips-5.0< 5.0.8-r19
cassandra-reaper< 5.0.1-r7
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4All versions (No fix recorded)
commercial-elasticsearch-9.5All versions (No fix recorded)
conductor< 3.32.5-r4
conductor-fips< 3.32.5-r4
confluent-kafka-jre-bcfips< 8.5.0.288-r1
cruise-control-fips-jars< 2.5.146-r8
cruise-control-jars< 2.5.146-r8
datahub-frontend< 1.7.0.1-r4
datahub-gms< 1.7.0.1-r2
datahub-gms-fips< 1.7.0.1-r3
dd-trace-java< 1.67.0-r1
druid< 38.0.0-r2
elasticsearch-8.19< 8.19.23-r1
elasticsearch-8.19-iamguarded-fips< 8.19.23-r1
elasticsearch-9.2< 9.2.8-r21
elasticsearch-9.2-iamguarded-fips< 9.2.8-r20
elasticsearch-9.3< 9.3.8-r15
elasticsearch-9.3-iamguarded-fips< 9.3.8-r7
elasticsearch-9.4< 9.4.8-r1
elasticsearch-9.4-iamguarded-fips< 9.4.8-r1
elasticsearch-9.5< 9.5.5-r2
elasticsearch-9.5-iamguarded-fips< 9.5.5-r1
elasticsearch-fips-8.19< 8.19.23-r1
elasticsearch-fips-9.2< 9.2.8-r20
elasticsearch-fips-9.3< 9.3.8-r7
elasticsearch-fips-9.4< 9.4.8-r1
elasticsearch-fips-9.5< 9.5.5-r1
flink-kubernetes-operator< 1.16.1-r4
flink-kubernetes-operator-fips< 1.16.1-r6
flywayAll versions (No fix recorded)
hadoop-fips-3.3.6< 3.3.6-r26
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r21
hono-adapter-mqtt< 2.7.0-r46
hono-cli< 2.7.0-r46
hono-service-command-router< 2.7.0-r46
hono-service-device-registry-jdbcAll versions (No fix recorded)
kafbat-ui< 1.5.0-r18
kafbat-ui-fips< 1.5.0-r10
kafka-3.7< 3.7.2-r63
kafka-3.8< 3.8.1-r65
kafka-3.9< 3.9.2-r18
kafka-4.0< 4.0.2-r15
kafka-4.1< 4.1.2-r12
kafka-4.2< 4.2.2-r3
kafka-4.3-openjdk-17< 4.3.1-r12
kafka-4.3-openjdk-21< 4.3.1-r12
kafka-4.3-openjdk-25< 4.3.1-r12
kafka-fips-4.1< 4.1.2-r14
kafka-fips-4.2< 4.2.2-r2
kafka-fips-4.3< 4.3.1-r10
kayenta-2026.3< 2026.3.7-r1
kayenta-fips-2026.3< 2026.3.7-r1
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r22
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r22
knative-kafka-broker-1.21-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-1.21-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-1.22-dispatcher-loom< 1.22.3-r19
knative-kafka-broker-1.22-receiver-loom< 1.22.3-r19
knative-kafka-broker-1.23-dispatcher-loom< 1.23.2-r2
knative-kafka-broker-1.23-receiver-loom< 1.23.2-r2
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r21
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r21
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.5-r11
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.5-r12 | < 1.21.5-r11
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.3-r16
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.3-r16
knative-kafka-broker-fips-1.23-dispatcher-loom< 1.23.2-r1
knative-kafka-broker-fips-1.23-receiver-loom< 1.23.2-r1
logstash-8.19< 8.19.23-r1
logstash-8.19-iamguarded-compat< 8.19.23-r1
logstash-8.19-with-output-opensearch< 8.19.23-r1
logstash-9.2< 9.2.8-r10
logstash-9.2-iamguarded-compat< 9.2.8-r10
logstash-9.2-with-output-opensearch< 9.2.8-r10
logstash-9.3< 9.3.8-r3
logstash-9.3-iamguarded-compat< 9.3.8-r3
logstash-9.4< 9.4.7-r6
logstash-9.4-iamguarded-compat< 9.4.7-r6
logstash-9.5< 9.5.4-r6
logstash-9.5-iamguarded-compat< 9.5.4-r6
logstash-fips-9.4All versions (No fix recorded) | < 9.4.7-r7
logstash-fips-9.4-iamguarded-compatAll versions (No fix recorded) | < 9.4.7-r7
logstash-fips-9.5< 9.5.4-r6
logstash-fips-9.5-iamguarded-compat< 9.5.4-r6
metabaseAll versions (No fix recorded) | < 0.63.19-r2
nuxeo-2023< 2023.45-r20
nuxeo-2025< 2025.20-r6
opensearch-2-securityAll versions (No fix recorded) | < 2.19.6-r21
opensearch-3-security< 3.9.0-r4
opensearch-fips-3-security< 3.9.0-r4
pinot< 1.5.1-r24
pinot-fips< 1.5.1-r20
rangerAll versions (No fix recorded)
seata-serverAll versions (No fix recorded) | < 2.7.0-r14
solr-10-full< 10.0.0-r17
solr-9-full< 9.11.0-r1
solr-fips-10-full< 10.0.0-r10
solr-fips-9-full< 9.10.1-r8
sonarqube< 26.9.0.129388-r5
spark-3.5-scala-2.12< 3.5.9-r6
spark-3.5-scala-2.13< 3.5.9-r6
spark-4.0-scala-2.13All versions (No fix recorded) | < 4.0.4-r9
spark-4.2-scala-2.13< 4.2.0-r16
spark-fips-3.5-scala-2.12< 3.5.8-r12
spark-fips-3.5-scala-2.13< 3.5.8-r12
spark-fips-4.1-scala-2.13< 4.1.2-r13 | All versions (No fix recorded)
spark-fips-4.2-scala-2.13< 4.2.0-r16
strimzi-kafka-operator-cluster-operatorAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-fips-cluster-operatorAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-kafka-agentAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-kafka-init< 1.2.0-r8
strimzi-kafka-operator-fips-topic-operatorAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-tracing-agentAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-user-operatorAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-kafka-agentAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-kafka-initAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-kafka-thirdparty-libs-ccAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-topic-operatorAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-tracing-agentAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-user-operatorAll versions (No fix recorded) | < 1.2.0-r10
thingsboard-tb-mqtt-transportAll versions (No fix recorded) | < 4.4-r1
thingsboard-tb-nodeAll versions (No fix recorded) | < 4.4-r1
traccar< 6.16.0-r4
traccar-fips< 6.16.0-r5
trino-plugin-clickhouseAll versions (No fix recorded) | < 483-r12
trino-plugin-delta-lakeAll versions (No fix recorded) | < 483-r12
trino-plugin-hiveAll versions (No fix recorded) | < 483-r12
trino-plugin-hudiAll versions (No fix recorded) | < 483-r12
trino-plugin-icebergAll versions (No fix recorded) | < 483-r12
trino-plugin-kafkaAll versions (No fix recorded) | < 483-r12
trino-plugin-kafka-event-listenerAll versions (No fix recorded) | < 483-r12
trino-plugin-lakehouseAll versions (No fix recorded) | < 483-r12
trino-plugin-pinotAll versions (No fix recorded) | < 483-r12
trino-plugin-rangerAll versions (No fix recorded) | < 483-r12
wazuh-indexer-plugin-security< 4.14.8-r5
wildfly-openjdk-17< 41.0.1-r6
wildfly-openjdk-21< 41.0.1-r6
wildfly-openjdk-25< 41.0.1-r6

Show all 164

Wolfi36 products

akhq< 0.28.0-r14
apache-pulsar-4.2< 4.2.5-r1
cassandra-4.1All versions (No fix recorded) | < 4.1.12-r4
cassandra-5.0< 5.0.9-r12
cassandra-reaper< 5.0.1-r7

Show all 36

2 vendors · 200 products · Showing 200 of 206. Use Open JSON for the complete list.

References

9 links

github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wrX Refsource CONFIRMREPORTAdvisoryWEB
github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8X Refsource MISCFIXWEB
github.com/yawkat/lz4-java/releases/tag/v1.11.4X Refsource MISCWEB
ubuntu.com/security/CVE-2026-106449REPORT
www.cve.org/CVERecord?id=CVE-2026-106449REPORT
security-tracker.debian.org/tracker/CVE-2026-106449Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106449.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-106449Advisory
github.com/yawkat/lz4-javaPACKAGE

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities