Skip to main content
Threat Radar animated logo

CVE-2026-106449: CWE-674: Uncontrolled Recursion in yawkat lz4-java

0
Low
VulnerabilityCVE-2026-106449cvecve-2026-106449cwe-674
Published: 10/06/2026 (10/06/2026, 19:46:28 UTC)
Source: CVE Database V5
Vendor/Project: yawkat
Product: lz4-java

Description

yawkat lz4-java versions prior to 1.11.4 have a vulnerability where the LZ4BlockInputStream class, when configured with stopOnEmptyBlock set to false, can recursively call refill() on empty LZ4 blocks. This can lead to stack exhaustion and a StackOverflowError. The default configuration (stopOnEmptyBlock true) is not affected. The issue does not cause memory corruption and is fixed in version 1.11.4.

CVSS v3.1

Score 3.7low

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected software

yawkat

lz4-java

Affected versions
<1.11.4
Mavenmore threats →ai
com.github.yawkat/lz4-java
pkg:maven/com.github.yawkat/lz4-java
Affected versions
<1.11.4

Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.

AI-Powered Analysis

Machine-generated threat intelligence

AILast updated: 10/06/2026, 20:19:30 UTC

Technical Analysis

The vulnerability in yawkat lz4-java (CVE-2026-106449) involves uncontrolled recursion in the LZ4BlockInputStream class when processing a sequence of empty LZ4 blocks with stopOnEmptyBlock set to false. Each empty block triggers a recursive call to refill(), which can exhaust the decoding thread's stack and cause a StackOverflowError. This affects versions prior to 1.11.4. The default setting (stopOnEmptyBlock true) is not vulnerable. The flaw does not lead to memory corruption and was addressed in version 1.11.4.

Potential Impact

An attacker can craft a compressed stream containing many empty LZ4 blocks to cause a StackOverflowError in the decoding thread, resulting in denial of service due to stack exhaustion. There is no impact on confidentiality or integrity, and no memory corruption occurs.

Mitigation Recommendations

Upgrade to yawkat lz4-java version 1.11.4 or later where this issue is fixed. If upgrading is not immediately possible, ensure that the stopOnEmptyBlock setting remains at its default value true to avoid triggering the recursion. No other mitigation is indicated.

Pro Console: star threats, build custom feeds, automate alerts via Slack, email & webhooks.Upgrade to Pro

Technical Details

Data Version
5.2
Assigner Short Name
GitHub_M
Date Reserved
2026-10-06T16:49:40.590Z
Cvss Version
3.1
State
PUBLISHED

Threat ID: 6ac550de2cdf04f656d8a12a

Added to database: 10/06/2026, 19:49:50 UTC

Last enriched: 10/06/2026, 20:19:30 UTC

Last updated: 10/06/2026, 20:28:31 UTC

Views: 5

Community Reviews

0 reviews

Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.

Sort by
Loading community insights…

Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.

Actions

PRO

Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.

Please log in to the Console to use AI analysis features.

Need more coverage?

Upgrade to Pro Console for AI refresh and higher limits.

For incident response and remediation, OffSeq services can help resolve threats faster.

Latest Threats

Breach by OffSeqOFFSEQFRIENDS — 25% OFF

Check if your credentials are on the dark web

Instant breach scanning across billions of leaked records. Free tier available.

Scan now
OffSeq TrainingCredly Certified

Lead Pen Test Professional

Technical5-day eLearningPECB Accredited
View courses