{"vulnerability": "CVE-2026-106450", "sightings": [{"uuid": "09f79b23-6876-4714-80ab-bb05944389d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-106450", "type": "seen", "source": "https://gist.github.com/alon710/9e7dbbb5a510a2569cc9f1ed5d544294", "content": "# CVE-2026-106450: CVE-2026-106450: Denial of Service via Eager Resource Allocation in lz4-java LZ4FrameInputStream\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-10-07\n> **Full Report:** https://cvereports.com/reports/CVE-2026-106450\n\n## Summary\nA resource allocation vulnerability (CWE-770) in lz4-java before version 1.11.4 allows an unauthenticated remote attacker to trigger CPU exhaustion and high garbage collection overhead by streaming empty concatenated LZ4 frames.\n\n## TL;DR\nlz4-java is vulnerable to a CPU and memory allocation Denial of Service. Eager buffer allocation during header parsing allows attackers to stream minimal, 11-byte empty frames that trigger repeated 8 MiB allocations, causing severe JVM Garbage Collection overhead.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-770\n- **Attack Vector**: Network\n- **CVSS v3.1**: 5.3 (Medium)\n- **EPSS Score**: 0.00371 (0.37%)\n- **Exploit Status**: Proof-of-Concept (PoC)\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Java applications utilizing lz4-java LZ4FrameInputStream for decompression\n- Web applications exposing endpoints that decompress LZ4 payload data\n- Log parsers, ingestion engines, or streaming pipelines handling LZ4 streams\n- **lz4-java**: < 1.11.4 (Fixed in: `1.11.4`)\n\n## Mitigation\n\n- Upgrade lz4-java to version 1.11.4 or higher\n- Limit incoming network throughput and connection concurrency\n- Implement aggressive timeout thresholds for decompression handlers\n\n**Remediation Steps:**\n1. Identify and update all references of org.lz4:lz4-java in pom.xml, build.gradle, or other build files.\n2. Upgrade the declared version to 1.11.4 or higher.\n3. Re-compile and run integration tests to verify the update.\n4. Deploy the patched binaries to production environments and monitor garbage collection logs.\n\n## References\n\n- [GitHub Security Advisory GHSA-gm45-99xc-r7wv](https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv)\n- [NVD - CVE-2026-106450](https://nvd.nist.gov/vuln/detail/CVE-2026-106450)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-106450) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-08T15:30:31.000000Z"}]}