CVE-2026-106452

The yawkat LZ4 Java library (prior to version 1.11.2 ) is vulnerable to a heap exhaustion issue in the net.jpountz.lz4.LZ4BlockInputStream.refill() function. The vulnerability occurs because the application validates that the compressedLen field in a legacy LZ4Block header is nonnegative but fail...

CVE-2026-106449

The yawkat LZ4 Java library (prior to version 1.11.4 ) contains a vulnerability in the net.jpountz.lz4.LZ4BlockInputStream component. When configured with stopOnEmptyBlock=false , the component recursively calls refill() for each well-formed empty LZ4Block. An attacker providing a compressed stre...