CVE-2026-106453: CWE-789: Memory Allocation with Excessive Size Value in yawkat lz4-java

yawkat lz4-java versions before 1.11.2 contain a vulnerability (CWE-789) where the LZ4DecompressorWithLength uses the decompressed-length header from input data to allocate memory without validating the compressed input size. An attacker can supply a crafted five-byte input with a large decompressed-length header, causing the decompressor to allocate up to about 2 GiB of memory, potentially exhausting the JVM heap. Convenience overloads that rely on LZ4FastDecompressor or LZ4SafeDecompressor are affected, while overloads that write to a caller-provided destination buffer are not vulnerable because the caller controls the buffer size. This vulnerability has a CVSS 3.1 score of 5.3 (medium severity) and was fixed in version 1.11.2.

An attacker can cause a denial of service by exhausting the JVM heap memory through excessive memory allocation during decompression. This does not affect confidentiality or integrity but impacts availability by potentially crashing or severely degrading the performance of the Java application using the vulnerable lz4-java library.

Upgrade to yawkat lz4-java version 1.11.2 or later, where this vulnerability is fixed. Avoid using convenience overloads that allocate memory based on untrusted decompressed-length headers. Use overloads that write to caller-provided destination buffers, as they are not affected by this issue.