Yawkat Lz4-java vulnerabilities

• yawkat lz4-java yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError CVE-2026-106453 Fix available 5.3 MediumOctober 6, 2026
• yawkat lz4-java yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header CVE-2026-106452 Fix available 5.3 MediumOctober 6, 2026
• yawkat lz4-java yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user CVE-2026-106451 Fix available 7.3 HighOctober 6, 2026
• yawkat lz4-java yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs CVE-2026-106450 Fix available 5.3 MediumOctober 6, 2026
• yawkat lz4-java yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError CVE-2026-106449 Fix available 3.7 LowOctober 6, 2026
• yawkat lz4-java yawkat LZ4 Java: JVM Crash via Null Byte Array in lz4-java Streaming XXHash JNI (StreamingXXHash32JNI / StreamingXXHash64JNI) CVE-2026-59949 Fix available 6.5 MediumJuly 24, 2026
• yawkat lz4-java yawkat LZ4 Java has a possible information leak in Java safe decompressor CVE-2025-66566 Fix available 8.2 HighDecember 5, 2025