CVE-2026-106452

A flaw was found in lz4-java. A remote attacker can trigger a Denial of Service (DoS) by providing a crafted compressed data stream with an oversized block header. During decompression, the input stream allocates memory based on this attacker-controlled size field before reading the actual payload, which can exhaust available Java Virtual Machine (JVM) memory and crash the application.

This vulnerability is rated as Moderate impact for Red Hat environments because successful exploitation is confined to application denial of service through heap exhaustion, without enabling unauthorized code execution or compromising data confidentiality. Across Red Hat products where this library is embedded, such as middleware runtimes and containerized AI tooling, data streams are generally consumed from authenticated or trusted pipelines rather than arbitrary external endpoints. Triggering the flaw requires an application to process untrusted compressed input using legacy block stream processing, limiting the overall risk profile under standard operational deployments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.