yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed input, allowing a five-byte attacker-supplied input whose header declares a large output size to request up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided destination buffer are not affected because the caller controls the destination size. This issue is fixed in version 1.11.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses
    getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed
    input, allowing a five-byte attacker-supplied input whose header declares a large output size to request
    up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or
    LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided
    destination buffer are not affected because the caller controls the destination size. This issue is fixed
    in version 1.11.2. (CVE-2026-106453)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.2, LZ4DecompressorWithLength uses     getDecompressedLength to trust the four-byte decompressed-length header before validating the compressed     input, allowing a five-byte attacker-supplied input whose header declares a large output size to request     up to approximately 2 GiB and exhaust the JVM heap. Convenience overloads backed by LZ4FastDecompressor or     LZ4SafeDecompressor allocate the untrusted size, while overloads that write to a caller-provided     destination buffer are not affected because the caller controls the destination size. This issue is fixed     in version 1.11.2. (CVE-2026-106453)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
474002	Echo: at.yawk.lz4:lz4-java: security update to 1.11.2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474002	Echo: at.yawk.lz4:lz4-java: security update to 1.11.2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473690	SCA: security update for at.yawk.lz4:lz4-java, org.lz4:lz4-java (GHSA-6cx8-rjf8-pr8g)	Tenable Cloud Security	SCA Checks	Local	medium
473690	SCA: security update for at.yawk.lz4:lz4-java, org.lz4:lz4-java (GHSA-6cx8-rjf8-pr8g)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
363803	Linux Distros Unpatched Vulnerability : CVE-2026-106453	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-106453

medium

Tenable Plugins

medium

medium

medium

medium

medium