{"items":[{"id":"NVI-00011873","kind":"vulnerability","title":"yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError","revision":3,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-343h-94h5-c4wr","CVE-2026-106449"],"plain_summary":"GitHub lists this reviewed advisory for at.yawk.lz4:lz4-java, org.lz4:lz4-java. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-00a6dfeb9bd4acf79fa026e41b84d2a5"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-07T20:35:46.000Z","value":"3.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4b9e3fbee44117b8ad6fec1ba1c58bd1"},{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.423%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.36731. Missing scores are unknown.","source_id":"sr-00a6dfeb9bd4acf79fa026e41b84d2a5"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4b9e3fbee44117b8ad6fec1ba1c58bd1","url":"https://github.com/advisories/GHSA-343h-94h5-c4wr","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-343h-94h5-c4wr","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:38.867Z"},{"id":"sr-00a6dfeb9bd4acf79fa026e41b84d2a5","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-106449","publisher":"FIRST EPSS","observed_at":"2026-11-04T17:58:50.309Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4b9e3fbee44117b8ad6fec1ba1c58bd1"],"technology":"at.yawk.lz4:lz4-java","known_exclusions":[],"conditions_summary":"### Summary\n\nWhen `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated block streams), it handles each empty block by calling `refill()` recursively. A long run of empty blocks exhausts the thread stack and throws `StackOverflowError` out of `read()` or `skip()`.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream.refill()`:\n\n```java\nif (originalLen == 0 && compressedLen == 0) {\n  if (check != 0) {\n    throw new IOException(\"Stream is corrupted\");\n  }\n  if (!stopOnEmptyBlock) {\n    refill();\n  } else {\n    finished = true;\n  }\n  return;\n}\n```\n\nEach well-formed empty block is 21 bytes and adds one stack frame, with no limit on nesting depth. In local testing, around 10,000 to 100,000 consecutive empty blocks (about 210 KB to 2.1 MB, depending on JIT state and thread stack size) threw `StackOverflowError`. `StackOverflowError` is an `Error`, not an `IOException`, so callers that only handle I/O errors for corrupt input don't catch it.\n\n### Impact\n\nApplications that decode attacker-controlled `LZ4Block` streams with `LZ4BlockInputStream.newBuilder().withStopOnEmptyBlock(false)` or the deprecated `LZ4BlockInputStream(InputStream, bool","public_affected_ranges":["<= 1.11.3"]},{"certainty":"source_listed","source_ids":["sr-4b9e3fbee44117b8ad6fec1ba1c58bd1"],"technology":"org.lz4:lz4-java","known_exclusions":[],"conditions_summary":"### Summary\n\nWhen `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated block streams), it handles each empty block by calling `refill()` recursively. A long run of empty blocks exhausts the thread stack and throws `StackOverflowError` out of `read()` or `skip()`.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream.refill()`:\n\n```java\nif (originalLen == 0 && compressedLen == 0) {\n  if (check != 0) {\n    throw new IOException(\"Stream is corrupted\");\n  }\n  if (!stopOnEmptyBlock) {\n    refill();\n  } else {\n    finished = true;\n  }\n  return;\n}\n```\n\nEach well-formed empty block is 21 bytes and adds one stack frame, with no limit on nesting depth. In local testing, around 10,000 to 100,000 consecutive empty blocks (about 210 KB to 2.1 MB, depending on JIT state and thread stack size) threw `StackOverflowError`. `StackOverflowError` is an `Error`, not an `IOException`, so callers that only handle I/O errors for corrupt input don't catch it.\n\n### Impact\n\nApplications that decode attacker-controlled `LZ4Block` streams with `LZ4BlockInputStream.newBuilder().withStopOnEmptyBlock(false)` or the deprecated `LZ4BlockInputStream(InputStream, bool","public_affected_ranges":["<= 1.8.1"]}],"null_published_at":"2026-11-06T07:24:11.217Z","source_updated_at":"2026-10-07T20:35:46.000Z","source_disclosed_at":"2026-10-07T20:35:46.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T00:58:38.867Z"},{"id":"NVI-00011873","kind":"vulnerability","title":"yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-343h-94h5-c4wr","CVE-2026-106449"],"plain_summary":"GitHub lists this reviewed advisory for at.yawk.lz4:lz4-java, org.lz4:lz4-java. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-941fd436313b7c9da85eed12aa593654"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-07T20:35:46.000Z","value":"3.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4b9e3fbee44117b8ad6fec1ba1c58bd1"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.423%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.36606. Missing scores are unknown.","source_id":"sr-941fd436313b7c9da85eed12aa593654"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4b9e3fbee44117b8ad6fec1ba1c58bd1","url":"https://github.com/advisories/GHSA-343h-94h5-c4wr","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-343h-94h5-c4wr","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:38.867Z"},{"id":"sr-941fd436313b7c9da85eed12aa593654","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-106449","publisher":"FIRST EPSS","observed_at":"2026-11-01T01:39:43.064Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4b9e3fbee44117b8ad6fec1ba1c58bd1"],"technology":"at.yawk.lz4:lz4-java","known_exclusions":[],"conditions_summary":"### Summary\n\nWhen `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated block streams), it handles each empty block by calling `refill()` recursively. A long run of empty blocks exhausts the thread stack and throws `StackOverflowError` out of `read()` or `skip()`.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream.refill()`:\n\n```java\nif (originalLen == 0 && compressedLen == 0) {\n  if (check != 0) {\n    throw new IOException(\"Stream is corrupted\");\n  }\n  if (!stopOnEmptyBlock) {\n    refill();\n  } else {\n    finished = true;\n  }\n  return;\n}\n```\n\nEach well-formed empty block is 21 bytes and adds one stack frame, with no limit on nesting depth. In local testing, around 10,000 to 100,000 consecutive empty blocks (about 210 KB to 2.1 MB, depending on JIT state and thread stack size) threw `StackOverflowError`. `StackOverflowError` is an `Error`, not an `IOException`, so callers that only handle I/O errors for corrupt input don't catch it.\n\n### Impact\n\nApplications that decode attacker-controlled `LZ4Block` streams with `LZ4BlockInputStream.newBuilder().withStopOnEmptyBlock(false)` or the deprecated `LZ4BlockInputStream(InputStream, bool","public_affected_ranges":["<= 1.11.3"]},{"certainty":"source_listed","source_ids":["sr-4b9e3fbee44117b8ad6fec1ba1c58bd1"],"technology":"org.lz4:lz4-java","known_exclusions":[],"conditions_summary":"### Summary\n\nWhen `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated block streams), it handles each empty block by calling `refill()` recursively. A long run of empty blocks exhausts the thread stack and throws `StackOverflowError` out of `read()` or `skip()`.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream.refill()`:\n\n```java\nif (originalLen == 0 && compressedLen == 0) {\n  if (check != 0) {\n    throw new IOException(\"Stream is corrupted\");\n  }\n  if (!stopOnEmptyBlock) {\n    refill();\n  } else {\n    finished = true;\n  }\n  return;\n}\n```\n\nEach well-formed empty block is 21 bytes and adds one stack frame, with no limit on nesting depth. In local testing, around 10,000 to 100,000 consecutive empty blocks (about 210 KB to 2.1 MB, depending on JIT state and thread stack size) threw `StackOverflowError`. `StackOverflowError` is an `Error`, not an `IOException`, so callers that only handle I/O errors for corrupt input don't catch it.\n\n### Impact\n\nApplications that decode attacker-controlled `LZ4Block` streams with `LZ4BlockInputStream.newBuilder().withStopOnEmptyBlock(false)` or the deprecated `LZ4BlockInputStream(InputStream, bool","public_affected_ranges":["<= 1.8.1"]}],"null_published_at":"2026-11-05T03:53:00.765Z","source_updated_at":"2026-10-07T20:35:46.000Z","source_disclosed_at":"2026-10-07T20:35:46.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T00:58:38.867Z"},{"id":"NVI-00011873","kind":"vulnerability","title":"yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-343h-94h5-c4wr","CVE-2026-106449"],"plain_summary":"GitHub lists this reviewed advisory for at.yawk.lz4:lz4-java, org.lz4:lz4-java. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-4b9e3fbee44117b8ad6fec1ba1c58bd1"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-07T20:35:46.000Z","value":"3.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-4b9e3fbee44117b8ad6fec1ba1c58bd1"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-4b9e3fbee44117b8ad6fec1ba1c58bd1","url":"https://github.com/advisories/GHSA-343h-94h5-c4wr","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-343h-94h5-c4wr","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:38.867Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-4b9e3fbee44117b8ad6fec1ba1c58bd1"],"technology":"at.yawk.lz4:lz4-java","known_exclusions":[],"conditions_summary":"### Summary\n\nWhen `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated block streams), it handles each empty block by calling `refill()` recursively. A long run of empty blocks exhausts the thread stack and throws `StackOverflowError` out of `read()` or `skip()`.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream.refill()`:\n\n```java\nif (originalLen == 0 && compressedLen == 0) {\n  if (check != 0) {\n    throw new IOException(\"Stream is corrupted\");\n  }\n  if (!stopOnEmptyBlock) {\n    refill();\n  } else {\n    finished = true;\n  }\n  return;\n}\n```\n\nEach well-formed empty block is 21 bytes and adds one stack frame, with no limit on nesting depth. In local testing, around 10,000 to 100,000 consecutive empty blocks (about 210 KB to 2.1 MB, depending on JIT state and thread stack size) threw `StackOverflowError`. `StackOverflowError` is an `Error`, not an `IOException`, so callers that only handle I/O errors for corrupt input don't catch it.\n\n### Impact\n\nApplications that decode attacker-controlled `LZ4Block` streams with `LZ4BlockInputStream.newBuilder().withStopOnEmptyBlock(false)` or the deprecated `LZ4BlockInputStream(InputStream, bool","public_affected_ranges":["<= 1.11.3"]},{"certainty":"source_listed","source_ids":["sr-4b9e3fbee44117b8ad6fec1ba1c58bd1"],"technology":"org.lz4:lz4-java","known_exclusions":[],"conditions_summary":"### Summary\n\nWhen `LZ4BlockInputStream` is configured with `stopOnEmptyBlock = false` (the mode for reading concatenated block streams), it handles each empty block by calling `refill()` recursively. A long run of empty blocks exhausts the thread stack and throws `StackOverflowError` out of `read()` or `skip()`.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream.refill()`:\n\n```java\nif (originalLen == 0 && compressedLen == 0) {\n  if (check != 0) {\n    throw new IOException(\"Stream is corrupted\");\n  }\n  if (!stopOnEmptyBlock) {\n    refill();\n  } else {\n    finished = true;\n  }\n  return;\n}\n```\n\nEach well-formed empty block is 21 bytes and adds one stack frame, with no limit on nesting depth. In local testing, around 10,000 to 100,000 consecutive empty blocks (about 210 KB to 2.1 MB, depending on JIT state and thread stack size) threw `StackOverflowError`. `StackOverflowError` is an `Error`, not an `IOException`, so callers that only handle I/O errors for corrupt input don't catch it.\n\n### Impact\n\nApplications that decode attacker-controlled `LZ4Block` streams with `LZ4BlockInputStream.newBuilder().withStopOnEmptyBlock(false)` or the deprecated `LZ4BlockInputStream(InputStream, bool","public_affected_ranges":["<= 1.8.1"]}],"null_published_at":"2026-11-01T01:03:56.611Z","source_updated_at":"2026-10-07T20:35:46.000Z","source_disclosed_at":"2026-10-07T20:35:46.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:38.867Z"}],"next_cursor":null,"snapshot_revision":"42594"}