Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-106450 EUVD-2026-93865GHSA-gm45-99xc-r7wv

yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

Published Oct 6, 2026 · Updated Oct 9, 2026 · Assigned by GitHub_M

Vendor: yawkat Product: lz4-java Package: akhq Package: apache-pulsar-4.2 Package: at.yawk.lz4:lz4-java Package: cassandra-4.1 Package: cassandra-5.0 Package: cassandra-reaper Package: debezium-3.5-connector-jdbc Package: debezium-3.5-connector-mariadb Package: debezium-3.5-connector-mongodb Package: debezium-3.5-connector-mysql Package: debezium-3.5-connector-postgres Package: debezium-3.5-connector-sqlserver Package: debezium-connector-db2-3.5 Package: debezium-connector-ibmi-3.5 Package: debezium-connector-spanner-3.5 Package: debezium-connector-vitess-3.5 Package: druid Package: flyway Package: kafka-4.1 Package: kafka-4.2 Package: logstash-9.3 Package: logstash-9.3-iamguarded-compat Package: logstash-9.4 Package: logstash-9.4-iamguarded-compat Package: lz4-java Package: lz4-java Package: opensearch-3-security Package: org.lz4:lz4-java Package: sonarqube Package: spark-4.0-scala-2.13 Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-hive Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-pinot Package: trino-plugin-ranger Package: wildfly-openjdk-17 Package: wildfly-openjdk-21 Package: zipkin Package: zipkin-slim Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.

Affected products

VendorProductAffectedFixed
yawkat lz4-java < 1.11.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 lz4-java No fix yet —
Debian 13 lz4-java No fix yet —
Debian 12 lz4-java No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 lz4-java No fix yet —
Ubuntu 26.04 LTS lz4-java No fix yet —
Ubuntu 24.04 LTS lz4-java No fix yet —
Ubuntu 22.04 LTS lz4-java No fix yet —
Ubuntu 20.04 LTS lz4-java No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.28.0-r14 —
Wolfi rolling apache-pulsar-4.2 4.2.5-r1 —
Wolfi rolling cassandra-4.1 4.1.12-r4 —
Wolfi rolling cassandra-5.0 5.0.9-r12 —
Wolfi rolling cassandra-reaper 5.0.1-r7 —
Wolfi rolling debezium-3.5-connector-jdbc +5 3.5.2-r12 —
Wolfi rolling debezium-connector-db2-3.5 +1 3.5.2-r6 —
Wolfi rolling debezium-connector-ibmi-3.5 +1 3.5.2-r11 —
Wolfi rolling druid 38.0.0-r2 —
Wolfi rolling flyway 13.11.1-r2 —
Wolfi rolling kafka-4.1 4.1.2-r12 —
Wolfi rolling kafka-4.2 4.2.2-r3 —
Wolfi rolling logstash-9.3 +1 9.3.8-r3 —
Wolfi rolling logstash-9.4 +1 9.4.7-r6 —
Wolfi rolling opensearch-3-security 3.9.0-r4 —
Wolfi rolling sonarqube 26.9.0.129388-r5 —
Wolfi rolling spark-4.0-scala-2.13 4.0.4-r9 —
Wolfi rolling strimzi-kafka-operator-kafka-init +6 1.2.0-r10 —
Wolfi rolling thingsboard-tb-node +1 4.4-r1 —
Wolfi rolling trino-plugin-hive +9 483-r12 —
Wolfi rolling wildfly-openjdk-17 +1 41.0.1-r6 —
Wolfi rolling zipkin +1 3.6.1-r35 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven at.yawk.lz4:lz4-java < 1.11.4 1.11.4 GHSA-gm45-99xc-r7wv
Maven org.lz4:lz4-java <= 1.8.1 — GHSA-gm45-99xc-r7wv

Advisories 1

References