CVE-2026-106453

A flaw was found in lz4-java. The library trusts the decompressed length header in compressed input before validating the input data, leading to uncontrolled memory allocation. A remote attacker can exploit this vulnerability by supplying a specially crafted input that specifies an excessively large output size. This action can exhaust available Java Virtual Machine (JVM) heap memory, resulting in an application crash and a Denial of Service (DoS).

This vulnerability is rated as Moderate impact because an attacker can trigger excessive memory allocation to cause a denial of service, with no impact on system confidentiality or integrity. Exploitation requires the target application to process untrusted compressed streams using specific length-prefixed decompression routines. Environments processing trusted inputs or applications managing their own output buffer allocations remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.