{"uuid": "0d6e4c12-6433-4a68-95b6-3a74f4efeb67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-106449", "type": "seen", "source": "https://gist.github.com/alon710/d620ea5022c68a565c6e73b0db64f7bb", "content": "# CVE-2026-106449: CVE-2026-106449: Stack Overflow via Uncontrolled Recursion in yawkat lz4-java\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-106449\n\n## Summary\nA Denial of Service (DoS) vulnerability exists in the yawkat fork of lz4-java prior to version 1.11.4. Under specific non-default configurations (stopOnEmptyBlock = false), parsing crafted streams with a large sequence of contiguous empty LZ4 blocks triggers uncontrolled recursion inside the LZ4BlockInputStream.refill() method, causing stack exhaustion and thread termination.\n\n## TL;DR\nAn uncontrolled recursion vulnerability in lz4-java allows remote attackers to trigger a stack overflow and thread termination by supplying compressed streams with repeated empty blocks when stopOnEmptyBlock is disabled.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-674 (Uncontrolled Recursion)\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: High (AC:H)\n- **CVSS Score**: 3.7 (Low)\n- **EPSS Score**: 0.00339 (Percentile: 25.20%)\n- **Impact Status**: Denial of Service (Thread Death)\n- **Exploit Status**: Proof of Concept Available\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Java applications using yawkat lz4-java prior to v1.11.4 with stopOnEmptyBlock set to false\n- **lz4-java**: < 1.11.4 (Fixed in: `1.11.4`)\n\n## Mitigation\n\n- Upgrade the lz4-java library to version 1.11.4 or higher.\n- Enforce stopOnEmptyBlock to true during the instantiation of LZ4BlockInputStream.\n- Implement deep validation of raw compressed payloads at edge gateways to identify and drop repeating structural blocks.\n\n**Remediation Steps:**\n1. Locate Maven pom.xml or Gradle build.gradle files containing 'org.lz4:lz4-java'.\n2. Update the version identifier coordinate to '1.11.4'.\n3. Scan application code for manual instantiations of net.jpountz.lz4.LZ4BlockInputStream.\n4. Ensure that any initialization of LZ4BlockInputStream passing stopOnEmptyBlock as false is safely removed or refactored.\n5. Recompile, run integration suites, and deploy the patched package to production.\n\n## References\n\n- [Fix Commit](https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8)\n- [Release v1.11.4](https://github.com/yawkat/lz4-java/releases/tag/v1.11.4)\n- [GitHub Security Advisory](https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-106449)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-106449)\n- [CVE Project Raw JSON Metadata File](https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106449.json)\n- [Wiz Vulnerability Database Details](https://www.wiz.io/vulnerability-database/cve/cve-2026-106449)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-106449) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T14:30:30.000000Z"}