CVE-2026-106452: yawkat lz4-java

CVSS: 5.3v3.1MediumAwaiting analysis

AliasesUBUNTU-CVE-2026-106452DEBIAN-CVE-2026-106452CGA-23cm-hw2r-fjmf+377 more

Published 06-10-2026Last modified 07-10-2026

Vulnerability summary

CVE-2026-106452 is a medium (CVSS 5.3) vulnerability in yawkat lz4-java. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 29.6% of scored vulnerabilities.

Overall risk

21/100

0100

Low · default modelHow is this calculated?

CVSS score

5.3/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.37%

0%100%

Low · Change unavailable

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

06-10-2026
PublishedVulnerability first disclosed.
07-10-2026
Last modifiedVulnerability information updated.

Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2.

CVSS metrics

7 scores · 7 sources · 1 version

v3.15.3

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

30%

Versus all other CVEs

30-day change

Change unavailable

07-10-202620-10-2026

EPSS score

0.37%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-789Memory Allocation with Excessive Size ValueThe product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Affected systems

Chainguard160 products

akhq< 0.28.0-r14
apache-hop-fips< 2.19.0-r5
apache-nifi-2.11< 2.11.0-r11
apache-nifi-2.12< 2.12.0-r5
apache-polaris< 1.8.0-r4

apache-polaris-fips< 1.7.0-r5
apache-pulsar-4.0< 4.0.14-r1
apache-pulsar-4.2< 4.2.5-r1
apache-pulsar-fips-4.0< 4.0.14-r1
apache-pulsar-fips-4.2< 4.2.5-r1
apicurio-registry-fips< 3.3.3-r4
automq< 1.7.4-r2
automq-fips< 1.7.4-r2
cassandra-4.0All versions (No fix recorded) | < 4.0.21-r4
cassandra-4.1All versions (No fix recorded) | < 4.1.12-r4
cassandra-5.0< 5.0.9-r11
cassandra-fips-4.0All versions (No fix recorded) | < 4.0.21-r5
cassandra-fips-4.1All versions (No fix recorded) | < 4.1.12-r5
cassandra-fips-5.0< 5.0.8-r19
cassandra-reaper< 5.0.1-r7
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.19All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.3All versions (No fix recorded)
commercial-elasticsearch-9.4All versions (No fix recorded)
commercial-elasticsearch-9.5All versions (No fix recorded)
conductor< 3.32.5-r4
conductor-fips< 3.32.5-r4
confluent-kafka-jre-bcfips< 8.5.0.288-r1
cruise-control-fips-jars< 2.5.146-r8
cruise-control-jars< 2.5.146-r8
datahub-frontend< 1.7.0.1-r4
datahub-gms< 1.7.0.1-r2
datahub-gms-fips< 1.7.0.1-r3
dd-trace-java< 1.67.0-r1
druid< 38.0.0-r2
elasticsearch-8.19< 8.19.23-r1
elasticsearch-8.19-iamguarded-fips< 8.19.23-r1
elasticsearch-9.2< 9.2.8-r21
elasticsearch-9.2-iamguarded-fips< 9.2.8-r20
elasticsearch-9.3< 9.3.8-r15
elasticsearch-9.3-iamguarded-fips< 9.3.8-r7
elasticsearch-9.4< 9.4.8-r1
elasticsearch-9.4-iamguarded-fips< 9.4.8-r1
elasticsearch-9.5< 9.5.5-r1
elasticsearch-9.5-iamguarded-fips< 9.5.5-r1
elasticsearch-fips-8.19< 8.19.23-r1
elasticsearch-fips-9.2< 9.2.8-r20
elasticsearch-fips-9.3< 9.3.8-r7
elasticsearch-fips-9.4< 9.4.8-r1
elasticsearch-fips-9.5< 9.5.5-r1
flink-kubernetes-operator< 1.16.1-r4
flink-kubernetes-operator-fips< 1.16.1-r5
flywayAll versions (No fix recorded)
hadoop-fips-3.3.6< 3.3.6-r26
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5< 3.5.0-r21
hono-adapter-mqtt< 2.7.0-r46
hono-cliAll versions (No fix recorded) | < 2.7.0-r46
hono-service-command-router< 2.7.0-r46
hono-service-device-registry-jdbcAll versions (No fix recorded)
kafbat-ui< 1.5.0-r18
kafbat-ui-fips< 1.5.0-r10
kafka-3.7< 3.7.2-r63
kafka-3.8< 3.8.1-r65
kafka-3.9< 3.9.2-r18
kafka-4.0< 4.0.2-r15
kafka-4.1< 4.1.2-r12
kafka-4.2< 4.2.2-r3
kafka-4.3-openjdk-17< 4.3.1-r12
kafka-4.3-openjdk-21< 4.3.1-r12
kafka-4.3-openjdk-25< 4.3.1-r12
kafka-fips-4.1< 4.1.2-r14
kafka-fips-4.3< 4.3.1-r10
kayenta-2026.3< 2026.3.7-r1
kayenta-fips-2026.3< 2026.3.7-r1
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r22
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r22
knative-kafka-broker-1.21-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-1.21-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-1.22-dispatcher-loom< 1.22.3-r19
knative-kafka-broker-1.22-receiver-loom< 1.22.3-r19
knative-kafka-broker-1.23-dispatcher-loom< 1.23.2-r1
knative-kafka-broker-1.23-receiver-loom< 1.23.2-r1
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r20
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r20
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.5-r11
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.5-r12 | < 1.21.5-r11
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.3-r16
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.3-r16
knative-kafka-broker-fips-1.23-dispatcher-loom< 1.23.2-r1
knative-kafka-broker-fips-1.23-receiver-loom< 1.23.2-r1
logstash-8.19< 8.19.23-r1
logstash-8.19-iamguarded-compat< 8.19.23-r1
logstash-8.19-with-output-opensearch< 8.19.23-r1
logstash-9.2< 9.2.8-r10
logstash-9.2-iamguarded-compat< 9.2.8-r10
logstash-9.2-with-output-opensearch< 9.2.8-r10
logstash-9.3< 9.3.8-r3
logstash-9.3-iamguarded-compat< 9.3.8-r3
logstash-9.4< 9.4.7-r6
logstash-9.4-iamguarded-compat< 9.4.7-r6
logstash-9.5< 9.5.4-r6
logstash-9.5-iamguarded-compat< 9.5.4-r6
logstash-fips-9.4All versions (No fix recorded) | < 9.4.7-r7
logstash-fips-9.4-iamguarded-compatAll versions (No fix recorded) | < 9.4.7-r7
logstash-fips-9.5< 9.5.4-r6
logstash-fips-9.5-iamguarded-compat< 9.5.4-r6
metabase< 0.63.19-r1
nuxeo-2023< 2023.45-r20
nuxeo-2025< 2025.20-r6
opensearch-2-securityAll versions (No fix recorded) | < 2.19.6-r20
pinot< 1.5.1-r24
pinot-fips< 1.5.1-r20
rangerAll versions (No fix recorded)
seata-server< 2.7.0-r13
solr-10-full< 10.0.0-r17
solr-9-full< 9.11.0-r1
solr-fips-10-full< 10.0.0-r10
solr-fips-9-full< 9.10.1-r8
sonarqube< 26.9.0.129388-r5
spark-3.5-scala-2.12< 3.5.9-r6
spark-3.5-scala-2.13< 3.5.9-r6
spark-4.0-scala-2.13All versions (No fix recorded) | < 4.0.4-r9
spark-4.2-scala-2.13< 4.2.0-r16
spark-fips-3.5-scala-2.12< 3.5.8-r12
spark-fips-3.5-scala-2.13< 3.5.8-r12
spark-fips-4.1-scala-2.13< 4.1.2-r13 | All versions (No fix recorded)
spark-fips-4.2-scala-2.13< 4.2.0-r16
strimzi-kafka-operator-cluster-operatorAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-fips-cluster-operatorAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-kafka-agentAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-kafka-init< 1.2.0-r8
strimzi-kafka-operator-fips-topic-operatorAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-tracing-agentAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-fips-user-operatorAll versions (No fix recorded) | < 1.2.0-r8
strimzi-kafka-operator-kafka-agentAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-kafka-initAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-kafka-thirdparty-libs-ccAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-topic-operatorAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-tracing-agentAll versions (No fix recorded) | < 1.2.0-r10
strimzi-kafka-operator-user-operatorAll versions (No fix recorded) | < 1.2.0-r10
thingsboard-tb-mqtt-transportAll versions (No fix recorded) | < 4.4-r1
thingsboard-tb-nodeAll versions (No fix recorded) | < 4.4-r1
traccar< 6.16.0-r4
traccar-fips< 6.16.0-r3
trino-plugin-clickhouseAll versions (No fix recorded) | < 483-r12
trino-plugin-delta-lakeAll versions (No fix recorded) | < 483-r12
trino-plugin-hiveAll versions (No fix recorded) | < 483-r12
trino-plugin-hudiAll versions (No fix recorded) | < 483-r12
trino-plugin-icebergAll versions (No fix recorded) | < 483-r12
trino-plugin-kafkaAll versions (No fix recorded) | < 483-r12
trino-plugin-kafka-event-listenerAll versions (No fix recorded) | < 483-r12
trino-plugin-lakehouseAll versions (No fix recorded) | < 483-r12
trino-plugin-pinotAll versions (No fix recorded) | < 483-r12
trino-plugin-rangerAll versions (No fix recorded) | < 483-r12
wazuh-indexer-plugin-security< 4.14.8-r5
wildfly-openjdk-17< 41.0.1-r6
wildfly-openjdk-21< 41.0.1-r6
wildfly-openjdk-25< 41.0.1-r6

Show all 160

Wolfi36 products

akhq< 0.28.0-r14
apache-pulsar-4.2< 4.2.5-r1
cassandra-4.1All versions (No fix recorded) | < 4.1.12-r4
cassandra-5.0< 5.0.9-r11
cassandra-reaper< 5.0.1-r7

Show all 36

At.yawk.lz41 product

lz4-java< 1.11.2

Debian1 product

lz4-javaAll versions (No fix recorded) | < 1.11.2+ds1-1

Org.lz41 product

lz4-java≤ 1.8.1

Ubuntu1 product

lz4-javaAll versions (No fix recorded)

6 vendors · 200 products · Showing 200 of 201. Use Open JSON for the complete list.

References

9 links

github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464X Refsource CONFIRMREPORTAdvisoryWEB
github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634X Refsource MISCFIXWEB
github.com/yawkat/lz4-java/releases/tag/v1.11.2X Refsource MISCWEB
ubuntu.com/security/CVE-2026-106452REPORT
www.cve.org/CVERecord?id=CVE-2026-106452REPORT
security-tracker.debian.org/tracker/CVE-2026-106452Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106452.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-106452Advisory
github.com/yawkat/lz4-javaPACKAGE

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities