CVE-2026-106450: yawkat lz4-java

CVSS: 5.3v3.1MediumAwaiting analysis

AliasesUBUNTU-CVE-2026-106450DEBIAN-CVE-2026-106450CGA-254f-hwm4-pjcw+385 more

Published 06-10-2026Last modified 09-10-2026

Vulnerability summary

CVE-2026-106450 is a medium (CVSS 5.3) vulnerability in yawkat lz4-java. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.5% of scored vulnerabilities.

Overall risk

21/100

0100

Low · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.37%

0%100%

Low · Change unavailable

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

06-10-2026
PublishedVulnerability first disclosed.
09-10-2026
Last modifiedVulnerability information updated.

Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.3

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

Change unavailable

07-10-202619-10-2026

EPSS score

0.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Affected systems

Chainguard164 products

akhq< 0.28.0-r14
apache-hop< 2.19.0-r7
apache-hop-fips< 2.19.0-r5
apache-nifi-2.11< 2.11.0-r11
apache-nifi-2.12< 2.12.0-r5

apache-polarisAll versions (No fix recorded) | < 1.8.0-r5
apache-polaris-fips< 1.7.0-r5
apache-pulsar-4.0< 4.0.14-r1
apache-pulsar-4.2< 4.2.5-r1
apache-pulsar-fips-4.0< 4.0.14-r1
apache-pulsar-fips-4.2< 4.2.5-r1
apicurio-registry-fips< 3.3.3-r4
automq< 1.7.4-r2
automq-fips< 1.7.4-r2
cassandra-4.0All versions (No fix recorded) | < 4.0.21-r4
cassandra-4.1All versions (No fix recorded) | < 4.1.12-r4
cassandra-5.0< 5.0.9-r12
cassandra-fips-4.0All versions (No fix recorded) | < 4.0.21-r5
cassandra-fips-4.1All versions (No fix recorded) | < 4.1.12-r5
cassandra-fips-5.0< 5.0.8-r19
cassandra-reaper< 5.0.1-r7
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4All versions (No fix recorded)
commercial-elasticsearch-9.5All versions (No fix recorded)
conductor< 3.32.5-r4
conductor-fips< 3.32.5-r4
confluent-kafka-jre-bcfips< 8.5.0.288-r1
cruise-control-fips-jars< 2.5.146-r8
cruise-control-jars< 2.5.146-r8
datahub-frontend< 1.7.0.1-r4
datahub-gms< 1.7.0.1-r2
datahub-gms-fips< 1.7.0.1-r3
dd-trace-java< 1.67.0-r1
druid< 38.0.0-r2
elasticsearch-8.19< 8.19.23-r1
elasticsearch-8.19-iamguarded-fips< 8.19.23-r1
elasticsearch-9.2< 9.2.8-r21
elasticsearch-9.2-iamguarded-fips< 9.2.8-r20
elasticsearch-9.3< 9.3.8-r15
elasticsearch-9.3-iamguarded-fips< 9.3.8-r7
elasticsearch-9.4< 9.4.8-r1
elasticsearch-9.4-iamguarded-fips< 9.4.8-r1
elasticsearch-9.5< 9.5.5-r2
elasticsearch-9.5-iamguarded-fips< 9.5.5-r1
elasticsearch-fips-8.19< 8.19.23-r1
elasticsearch-fips-9.2< 9.2.8-r20
elasticsearch-fips-9.3< 9.3.8-r7
elasticsearch-fips-9.4< 9.4.8-r1
elasticsearch-fips-9.5< 9.5.5-r1
flink-kubernetes-operator< 1.16.1-r4
flink-kubernetes-operator-fips< 1.16.1-r6
flywayAll versions (No fix recorded)
hadoop-fips-3.3.6< 3.3.6-r26
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r21
hono-adapter-mqtt< 2.7.0-r46
hono-cli< 2.7.0-r46
hono-service-command-router< 2.7.0-r46
hono-service-device-registry-jdbcAll versions (No fix recorded)
kafbat-ui< 1.5.0-r18
kafbat-ui-fips< 1.5.0-r10
kafka-3.7< 3.7.2-r63
kafka-3.8< 3.8.1-r65
kafka-3.9< 3.9.2-r18
kafka-4.0< 4.0.2-r15
kafka-4.1< 4.1.2-r12
kafka-4.2< 4.2.2-r3
kafka-4.3-openjdk-17< 4.3.1-r12
kafka-4.3-openjdk-21< 4.3.1-r12
kafka-4.3-openjdk-25< 4.3.1-r12
kafka-fips-4.1< 4.1.2-r14
kafka-fips-4.2< 4.2.2-r2
kafka-fips-4.3< 4.3.1-r10
kayenta-2026.3< 2026.3.7-r1
kayenta-fips-2026.3< 2026.3.7-r1
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r22
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r22
knative-kafka-broker-1.21-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-1.21-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-1.22-dispatcher-loom< 1.22.3-r19
knative-kafka-broker-1.22-receiver-loom< 1.22.3-r19
knative-kafka-broker-1.23-dispatcher-loom< 1.23.2-r2
knative-kafka-broker-1.23-receiver-loom< 1.23.2-r2
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r21
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r21
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.5-r11
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.5-r12 | < 1.21.5-r11
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.3-r16
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.3-r16
knative-kafka-broker-fips-1.23-dispatcher-loom< 1.23.2-r1
knative-kafka-broker-fips-1.23-receiver-loom< 1.23.2-r1
logstash-8.19< 8.19.23-r1
logstash-8.19-iamguarded-compat< 8.19.23-r1
logstash-8.19-with-output-opensearch< 8.19.23-r1
logstash-9.2< 9.2.8-r10
logstash-9.2-iamguarded-compat< 9.2.8-r10
logstash-9.2-with-output-opensearch< 9.2.8-r10
logstash-9.3< 9.3.8-r3
logstash-9.3-iamguarded-compat< 9.3.8-r3
logstash-9.4< 9.4.7-r6
logstash-9.4-iamguarded-compat< 9.4.7-r6
logstash-9.5< 9.5.4-r6
logstash-9.5-iamguarded-compat< 9.5.4-r6
logstash-fips-9.4All versions (No fix recorded) | < 9.4.7-r7
logstash-fips-9.4-iamguarded-compatAll versions (No fix recorded) | < 9.4.7-r7
logstash-fips-9.5< 9.5.4-r6
logstash-fips-9.5-iamguarded-compat< 9.5.4-r6
metabaseAll versions (No fix recorded) | < 0.63.19-r2
nuxeo-2023< 2023.45-r20
nuxeo-2025< 2025.20-r6
opensearch-2-securityAll versions (No fix recorded) | < 2.19.6-r21
opensearch-3-security< 3.9.0-r4
opensearch-fips-3-security< 3.9.0-r4
pinot< 1.5.1-r24
pinot-fips< 1.5.1-r20
rangerAll versions (No fix recorded)
seata-serverAll versions (No fix recorded) | < 2.7.0-r14
solr-10-full< 10.0.0-r17
solr-9-full< 9.11.0-r1
solr-fips-10-full< 10.0.0-r10
solr-fips-9-full< 9.10.1-r8
sonarqube< 26.9.0.129388-r5
spark-3.5-scala-2.12< 3.5.9-r6
spark-3.5-scala-2.13< 3.5.9-r6
spark-4.0-scala-2.13All versions (No fix recorded) | < 4.0.4-r9
spark-4.2-scala-2.13< 4.2.0-r16
spark-fips-3.5-scala-2.12< 3.5.8-r12
spark-fips-3.5-scala-2.13< 3.5.8-r12
spark-fips-4.1-scala-2.13< 4.1.2-r13 | All versions (No fix recorded)
spark-fips-4.2-scala-2.13< 4.2.0-r16
strimzi-kafka-operator-cluster-operatorAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-fips-cluster-operatorAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-kafka-agentAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-kafka-initAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-topic-operatorAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-tracing-agent< 1.2.0-r8
strimzi-kafka-operator-fips-user-operatorAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-kafka-agentAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-kafka-initAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-kafka-thirdparty-libs-ccAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-topic-operatorAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-tracing-agentAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-user-operatorAll versions (No fix recorded) | < 1.2.0-r10
thingsboard-tb-mqtt-transportAll versions (No fix recorded) | < 4.4-r1
thingsboard-tb-nodeAll versions (No fix recorded) | < 4.4-r1
traccar< 6.16.0-r4
traccar-fips< 6.16.0-r5
trino-plugin-clickhouseAll versions (No fix recorded) | < 483-r12
trino-plugin-delta-lakeAll versions (No fix recorded) | < 483-r12
trino-plugin-hiveAll versions (No fix recorded) | < 483-r12
trino-plugin-hudiAll versions (No fix recorded) | < 483-r12
trino-plugin-icebergAll versions (No fix recorded) | < 483-r12
trino-plugin-kafkaAll versions (No fix recorded) | < 483-r12
trino-plugin-kafka-event-listenerAll versions (No fix recorded) | < 483-r12
trino-plugin-lakehouseAll versions (No fix recorded) | < 483-r12
trino-plugin-pinotAll versions (No fix recorded) | < 483-r12
trino-plugin-rangerAll versions (No fix recorded) | < 483-r12
wazuh-indexer-plugin-security< 4.14.8-r5
wildfly-openjdk-17< 41.0.1-r6
wildfly-openjdk-21< 41.0.1-r6
wildfly-openjdk-25< 41.0.1-r6

Show all 164

Wolfi36 products

akhq< 0.28.0-r14
apache-pulsar-4.2< 4.2.5-r1
cassandra-4.1All versions (No fix recorded) | < 4.1.12-r4
cassandra-5.0< 5.0.9-r12
cassandra-reaper< 5.0.1-r7

Show all 36

2 vendors · 200 products · Showing 200 of 206. Use Open JSON for the complete list.

References

9 links

github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wvX Refsource CONFIRMREPORTAdvisoryWEB
github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283X Refsource MISCFIXWEB
github.com/yawkat/lz4-java/releases/tag/v1.11.4X Refsource MISCWEB
ubuntu.com/security/CVE-2026-106450REPORT
www.cve.org/CVERecord?id=CVE-2026-106450REPORT
security-tracker.debian.org/tracker/CVE-2026-106450Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106450.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-106450Advisory
github.com/yawkat/lz4-javaPACKAGE

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities