Skip to content
OpenAdvisories
Low · 3.7 CVE-2026-106449 EUVD-2026-93862GHSA-343h-94h5-c4wr

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

Published Oct 6, 2026 · Updated Oct 7, 2026 · Assigned by GitHub_M

Vendor: yawkat Product: lz4-java Package: akhq Package: apache-pulsar-4.2 Package: at.yawk.lz4:lz4-java Package: cassandra-4.1 Package: cassandra-5.0 Package: cassandra-reaper Package: debezium-3.5-connector-jdbc Package: debezium-3.5-connector-mariadb Package: debezium-3.5-connector-mongodb Package: debezium-3.5-connector-mysql Package: debezium-3.5-connector-postgres Package: debezium-3.5-connector-sqlserver Package: debezium-connector-db2-3.5 Package: debezium-connector-ibmi-3.5 Package: debezium-connector-spanner-3.5 Package: debezium-connector-vitess-3.5 Package: druid Package: flyway Package: kafka-4.1 Package: kafka-4.2 Package: logstash-9.3 Package: logstash-9.3-iamguarded-compat Package: logstash-9.4 Package: logstash-9.4-iamguarded-compat Package: lz4-java Package: lz4-java Package: opensearch-3-security Package: org.lz4:lz4-java Package: sonarqube Package: spark-4.0-scala-2.13 Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-hive Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-pinot Package: trino-plugin-ranger Package: wildfly-openjdk-17 Package: wildfly-openjdk-21 Package: zipkin Package: zipkin-slim Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.

Affected products

VendorProductAffectedFixed
yawkat lz4-java < 1.11.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 lz4-java No fix yet —
Debian 13 lz4-java No fix yet —
Debian 12 lz4-java No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 lz4-java No fix yet —
Ubuntu 26.04 LTS lz4-java No fix yet —
Ubuntu 24.04 LTS lz4-java No fix yet —
Ubuntu 22.04 LTS lz4-java No fix yet —
Ubuntu 20.04 LTS lz4-java No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.28.0-r14 —
Wolfi rolling apache-pulsar-4.2 4.2.5-r1 —
Wolfi rolling cassandra-4.1 4.1.12-r4 —
Wolfi rolling cassandra-5.0 5.0.9-r12 —
Wolfi rolling cassandra-reaper 5.0.1-r7 —
Wolfi rolling debezium-3.5-connector-jdbc +5 3.5.2-r12 —
Wolfi rolling debezium-connector-db2-3.5 +1 3.5.2-r6 —
Wolfi rolling debezium-connector-ibmi-3.5 +1 3.5.2-r11 —
Wolfi rolling druid 38.0.0-r2 —
Wolfi rolling flyway 13.11.1-r2 —
Wolfi rolling kafka-4.1 4.1.2-r12 —
Wolfi rolling kafka-4.2 4.2.2-r3 —
Wolfi rolling logstash-9.3 +1 9.3.8-r3 —
Wolfi rolling logstash-9.4 +1 9.4.7-r6 —
Wolfi rolling opensearch-3-security 3.9.0-r4 —
Wolfi rolling sonarqube 26.9.0.129388-r5 —
Wolfi rolling spark-4.0-scala-2.13 4.0.4-r9 —
Wolfi rolling strimzi-kafka-operator-kafka-init +6 1.2.0-r10 —
Wolfi rolling thingsboard-tb-node +1 4.4-r1 —
Wolfi rolling trino-plugin-hive +9 483-r12 —
Wolfi rolling wildfly-openjdk-17 +1 41.0.1-r6 —
Wolfi rolling zipkin +1 3.6.1-r35 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven at.yawk.lz4:lz4-java < 1.11.4 1.11.4 GHSA-343h-94h5-c4wr
Maven org.lz4:lz4-java <= 1.8.1 — GHSA-343h-94h5-c4wr

Advisories 1

References