yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks when compression is not smaller than the original block, but vulnerable readers accept non-canonical oversized compressed blocks. This issue is fixed in version 1.11.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream
    refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a
    compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-
    only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks
    when compression is not smaller than the original block, but vulnerable readers accept non-canonical
    oversized compressed blocks. This issue is fixed in version 1.11.2. (CVE-2026-106452)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, net.jpountz.lz4.LZ4BlockInputStream     refill() validates that the compressedLen field in a legacy LZ4Block header is nonnegative but allocates a     compressed-input buffer of that attacker-controlled size before reading payload data, allowing a header-     only stream to request a near-2 GiB allocation and exhaust the JVM heap. Canonical writers emit raw blocks     when compression is not smaller than the original block, but vulnerable readers accept non-canonical     oversized compressed blocks. This issue is fixed in version 1.11.2. (CVE-2026-106452)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
473997	Echo: at.yawk.lz4:lz4-java: security update to 1.11.2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473997	Echo: at.yawk.lz4:lz4-java: security update to 1.11.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473703	SCA: security update for at.yawk.lz4:lz4-java, org.lz4:lz4-java (GHSA-4v53-57pg-c464)	Tenable Cloud Security	SCA Checks	Local	medium
473703	SCA: security update for at.yawk.lz4:lz4-java, org.lz4:lz4-java (GHSA-4v53-57pg-c464)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
363800	Linux Distros Unpatched Vulnerability : CVE-2026-106452	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-106452

medium

Tenable Plugins

medium

medium

medium

medium

medium