CVE-2026-106453 (CVSS 5.3)

Description

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.

Is your site exposed to CVE-2026-106453?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS — Exploit Prediction

0.0037

Probability of exploitation

0.29%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-789 CWE-789

References

Other References

https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a https://github.com/yawkat/lz4-java/releases/tag/v1.11.2 https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g

Frequently Asked Questions

What is CVE-2026-106453? +

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2026-106453? +

CVE-2026-106453 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0037, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-106453? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-83745

Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift nodejs and D lang …

CVE-2026-63574

Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket, UserAttributeSubpacketsParser.ReadPacket) in Legion of …

CVE-2026-67551

pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects …

CVE-2026-67589

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue …

CVE-2026-83530

A user could provide an expression whose string length is longer than the ParserExpressionSizeLimit() configured on the CEL environment, and …

CVE-2026-107223

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded …

CVE-2026-106453