What is CVE-2026-106450?

CVE-2026-106450 is a medium-severity vulnerability in Yawkat Lz4-Java, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2026-10-06.

How severe is CVE-2026-106450?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Resource exhaustion in Yawkat Lz4-Java

CVE-2026-106450

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.

Published 2026-10-06 · last modified 2026-10-07.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Yawkat Lz4-Java — versions < 1.11.4

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

Frequently asked questions

What is CVE-2026-106450?: CVE-2026-106450 is a medium-severity vulnerability in Yawkat Lz4-Java, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2026-10-06.
How severe is CVE-2026-106450?: Medium severity. CVSS v3 base score is 5.3 out of 10.