CVE-2026-106452
Record from NVD · Published October 6, 2026
lz4-java is fixed in 1.8.1 (Maven Central)
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2.
EPSS 0.45% · 39.3th percentile
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| org.lz4:lz4-java | Maven Central | 1.8.1 |
| debezium-connector-ibmi-3.5 | Chainguard | 3.5.2-r11 |
| elasticsearch-fips-9.4 | Chainguard | 9.4.8-r1 |
| solr-10 | Chainguard | 10.0.0-r17 |
| kafka-4.3 | Chainguard | 4.3.1-r12 |
| logstash-8.19 | Chainguard | 8.19.23-r1 |
| solr-fips-9 | Chainguard | 9.10.1-r8 |
| knative-kafka-broker-1.22 | Chainguard | 1.22.3-r19 |
| spark-fips-3.5 | Chainguard | 3.5.8-r12 |
| apache-nifi-2.12 | Chainguard | 2.12.0-r5 |
| spark-fips-4.1 | Chainguard | 4.1.2-r13 |
| trino | Wolfi | 484-r0, 483-r12 |
88 more packages have a fixed version. See every fix in Lookup.
Risk scores
Timeline
- Oct 6, 2026 Coalition ESS Score
- Oct 6, 2026 CVE Published
- Oct 7, 2026 CVE Updated
- Oct 7, 2026 EPSS Score (9 in total, the first dated here)
- Nov 4, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-106452
vulnetix vdb fixes CVE-2026-106452Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-106452/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart