{"cve":"CVE-2026-106449","nvd":{"published":"2026-10-06T20:17:26.887","modified":"2026-10-07T17:16:47.877","status":"Awaiting Analysis","description":"yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","score":3.7},"cwes":["CWE-674"],"references":["https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8","https://github.com/yawkat/lz4-java/releases/tag/v1.11.4","https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:58:01.639778232+00:00"},"epss":{"cve":"CVE-2026-106449","score":0.00423,"percentile":0.36318,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-343h-94h5-c4wr","url":"https://osv.dev/vulnerability/GHSA-343h-94h5-c4wr","summary":"yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError","modified":"2026-10-07T20:45:07.306709237Z","packages":[{"ecosystem":"Maven","name":"at.yawk.lz4:lz4-java","purl":"pkg:maven/at.yawk.lz4/lz4-java","ranges":["<1.11.4"],"fixed":["1.11.4"]},{"ecosystem":"Maven","name":"org.lz4:lz4-java","purl":"pkg:maven/org.lz4/lz4-java","ranges":["<=1.8.1"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}