CVE-2026-106450

A flaw was found in lz4-java. By supplying a specially crafted stream containing many small frame headers, a remote attacker can trigger disproportionate memory allocations during decompression. This excessive allocation consumes substantial memory and processing resources, potentially leading to a Denial of Service (DoS).

Red Hat Product Security rates this vulnerability as having a Moderate severity because the impact is limited to denial of service through memory exhaustion and CPU starvation, with no compromise of system confidentiality or integrity. Exploitation requires an application to process untrusted compressed payloads from external sources. In typical Red Hat deployments, this library is primarily utilized within authenticated or internal data processing pipelines, restricting exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.