GHSA-343H-94H5-C4WR yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

Summary When LZ4BlockInputStream is configured with stopOnEmptyBlock = false the mode for reading concatenated block streams, it handles each empty block by calling refill recursively. A long run of empty blocks exhausts the thread stack and throws StackOverflowError out of read or skip. Details ...

EUVD-2026-93862

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError...

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

Summary When LZ4BlockInputStream is configured with stopOnEmptyBlock = false the mode for reading concatenated block streams, it handles each empty block by calling refill recursively. A long run of empty blocks exhausts the thread stack and throws StackOverflowError out of read or skip. Details ...

Linux Distros Unpatched Vulnerability : CVE-2026-106449

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles ea...

yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

When LZ4BlockInputStream is configured with stopOnEmptyBlock = false the mode for reading concatenated block streams, it handles each empty block by calling refill recursively. A long run of empty blocks exhausts the thread stack and throws StackOverflowError out of read or skip...

DEBIAN-CVE-2026-106449

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

CVE-2026-106449

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

CVE-2026-106449 yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

CVE-2026-106449 yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

CVE-2026-106449

The yawkat LZ4 Java library (prior to version 1.11.4 ) contains a vulnerability in the net.jpountz.lz4.LZ4BlockInputStream component. When configured with stopOnEmptyBlock=false , the component recursively calls refill() for each well-formed empty LZ4Block. An attacker providing a compressed stre...

CVE-2026-106449

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

CVE-2026-106449 yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

Denial-of-service (DoS)

org.apache.qpid, protonj2 is vulnerable to a Denial-of-service DoS. The vulnerability is due to excessive type nesting during message processing, which allows a pre-authentication attacker to trigger deeply nested types and cause a StackOverflowError...

CVE-2026-106449: Uncontrolled Recursion

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

PT-2026-107185

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions prior to 1.11.4 Description A flaw exists in the net.jpountz.lz4.LZ4BlockInputStream class when the stopOnEmptyBlock variable is set to false. In this configuration, the system handles well-formed empty LZ4Blocks by...

Denial-of-service (DoS)

org.apache.qpid, qpid-broker-plugins-amqp-1-0-protocol is vulnerable to a Denial-of-service DoS. The vulnerability is due to type nesting that can trigger a StackOverflowError, which allows a pre-authentication attacker to send specially crafted nested data and potentially crash the broker...

FreeBSD : apache-commons-lang -- Uncontrolled Recursion vulnerability (a7738854-bc00-11f1-a829-dca632daf43b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a7738854-bc00-11f1-a829-dca632daf43b advisory. OSS-Fuzz, Gary Gregory reports: Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue...

AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-core (ALMALINUX9.2:CLSA-2025:1764235184)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764235184 advisory. - jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. In versions...

AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-jaxrs-json-provider / pki-jackson-jaxrs-providers / etc (ALMALINUX9.2:CLSA-2025:1764771605)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764771605 advisory. - jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. In versions...

AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-module-jaxb-annotations / pki-jackson-modules-base (ALMALINUX9.2:CLSA-2025:1764772111)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764772111 advisory. - jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. In versions...