yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream
    readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and
    the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty
    frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no
    decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not
    mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.
    (CVE-2026-106450)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream     readHeader() allocates two new 4 MiB block buffers whenever a maximum-block-size frame header is read, and     the default concatenated-frame mode allows attacker-controlled streams containing many minimal empty     frames to trigger roughly 8 MiB of allocation for every 11 input bytes. The stream produces no     decompressed output while consuming CPU and garbage-collection time, so decompressed-size limits do not     mitigate the issue; readSingleFrame mode is not affected. This issue is fixed in version 1.11.4.
    (CVE-2026-106450)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473993	Echo: at.yawk.lz4:lz4-java: security update to 1.11.4	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473993	Echo: at.yawk.lz4:lz4-java: security update to 1.11.4	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473755	SCA: security update for at.yawk.lz4:lz4-java, org.lz4:lz4-java (GHSA-gm45-99xc-r7wv)	Tenable Cloud Security	SCA Checks	Local	medium
473755	SCA: security update for at.yawk.lz4:lz4-java, org.lz4:lz4-java (GHSA-gm45-99xc-r7wv)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
363804	Linux Distros Unpatched Vulnerability : CVE-2026-106450	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-106450

medium

Tenable Plugins

medium

medium

medium

medium

medium