CVE-2026-106449 | Vulnetix

CVE-2026-106449 PUBLISHED CVSS 9.300000190734863 CRITICAL

Record from NVD · Published October 6, 2026

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4BlockInputStream configured with stopOnEmptyBlock set to false handles each well-formed empty LZ4Block by recursively calling refill(), allowing a long sequence of empty blocks in an attacker-controlled compressed stream to exhaust the decoding thread's stack and throw StackOverflowError. The default stopOnEmptyBlock setting is true and is not affected, and the issue does not cause memory corruption. This issue is fixed in version 1.11.4.

EPSS 0.42% · 36.6th percentile

Risk scores

CVSS 4.0

9.300000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.42%

36.6th percentile

Timeline

Oct 6, 2026 Coalition ESS Score
Oct 6, 2026 CVE Published
Oct 7, 2026 CVE Updated
Oct 7, 2026 EPSS Score (11 in total, the first dated here)
Nov 4, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2026-106449
vulnetix vdb fixes CVE-2026-106449

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-106449/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →