CVE-2026-106453

Katalog CVE

CVSS 5.3 · Medium EPSS 0,37%

Kerentanan Memory Allocation with Excessive Size Value. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

7 Oktober 2026

Status NVD

Awaiting Analysis

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-789: Memory Allocation with Excessive Size Value

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 29,2% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/yawkat/lz4-java/commit/6492ce5aca6bd03ff9e08ee18a2beb94c431371a
• https://github.com/yawkat/lz4-java/releases/tag/v1.11.2
• https://github.com/yawkat/lz4-java/security/advisories/GHSA-6cx8-rjf8-pr8g