CVE-2026-106453
Reported by github_m · Published October 6, 2026
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| debezium-connector-ibmi-3.5 | Wolfi | 3.5.2-r11 |
| cassandra-4.1 | Wolfi | 4.1.12-r4 |
| kafka-3.7 | Chainguard | 3.7.2-r63 |
| knative-kafka-broker-fips-1.20 | Chainguard | 1.20.3-r20 |
| kayenta-2026.3 | Chainguard | 2026.3.7-r1 |
| debezium-3.5 | Wolfi | 3.5.2-r12 |
| cassandra-fips-4.1 | Chainguard | 4.1.12-r5 |
| wildfly | Chainguard | 41.0.1-r6 |
| thingsboard | Chainguard | 4.4-r1 |
| debezium-connector-spanner-3.5 | Wolfi | 3.5.2-r11 |
| hadoop-fips-3.3.6 | Chainguard | 3.3.6-r26 |
| apicurio-registry-fips | Chainguard | 3.3.3-r4 |
40 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| yawkat | lz4-java | < 1.11.2 |
| wolfi | debezium-connector-ibmi-3.5 | 0 |
| wolfi | cassandra-4.1 | 0 |
| chainguard | kafka-3.7 | 0 |
| chainguard | knative-kafka-broker-fips-1.20 | 0 |
| chainguard | kayenta-2026.3 | 0 |
| wolfi | debezium-3.5 | 0 |
| chainguard | cassandra-fips-4.1 | 0 |
| chainguard | wildfly | 0 |
| chainguard | thingsboard | 0 |
| wolfi | debezium-connector-spanner-3.5 | 0 |
| chainguard | hadoop-fips-3.3.6 | 0 |
| chainguard | apicurio-registry-fips | 0 |
| chainguard | logstash-9.4 | 0 |
| chainguard | apache-polaris | 0 |
| chainguard | akhq | 0 |
| chainguard | datahub-gms-fips | 0 |
| chainguard | automq-fips | 0 |
| chainguard | elasticsearch-8.19 | 0 |
| chainguard | kayenta-fips-2026.3 | 0 |
…and 108 more
Timeline
- Oct 6, 2026 CVE Published
- Oct 7, 2026 CVE Updated
- Oct 7, 2026 EPSS Score (10 in total, the first dated here)
- Nov 4, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-106453
vulnetix vdb fixes CVE-2026-106453Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-106453/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g x_refsource_CONFIRM
- https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a x_refsource_MISC
- https://github.com/yawkat/lz4-java/releases/tag/v1.11.2 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-106453 advisory
- https://github.com/advisories/GHSA-6cx8-rjf8-pr8g advisory