CVE-2026-106452 yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data,...

CVE-2026-106452

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data,...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3573 more potentially affected by CVE-2026-106452 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.1)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106452 Source advisory: MEND:CVE-2026-106452...

CVE-2026-106451 yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3720 more potentially affected by CVE-2026-106451 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106451 Source advisory: MEND:CVE-2026-106451...

CVE-2026-106451

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

CVE-2026-106451 yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

CVE-2026-106451

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

CVE-2026-106451 yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

CVE-2026-106451

The yawkat LZ4 Java library (versions 1.7.0 through 1.11.4 ) is vulnerable to a TOCTOU race condition during native library extraction. The net.jpountz.util.Native.load() function creates a temporary .lck file but uses a predictable path for the actual native library. Because FileOutputStream ope...

CVE-2026-106450 yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3720 more potentially affected by CVE-2026-106450 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106450 Source advisory: MEND:CVE-2026-106450...

CVE-2026-106450 yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

CVE-2026-106450

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

CVE-2026-106450

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

CVE-2026-106450 yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many...

CVE-2026-106450

Prior to version 1.11.4 , yawkat LZ4 Java is vulnerable to a resource exhaustion issue in the net.jpountz.lz4.LZ4FrameInputStream.readHeader() function. When processing a maximum-block-size frame header in the default concatenated-frame mode, the component allocates two new 4 MiB block buffers. A...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3720 more potentially affected by CVE-2026-106449 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106449 Source advisory: MEND:CVE-2026-106449...

CVE-2026-106449 yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...

CVE-2026-106449

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill, allowing a long sequence of empty blocks in an attacker-controlled compresse...