{"items":[{"id":"NVI-00012153","kind":"vulnerability","title":"yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4v53-57pg-c464","CVE-2026-106452"],"plain_summary":"GitHub lists this reviewed advisory for at.yawk.lz4:lz4-java, org.lz4:lz4-java. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1f253ef07d2bed67c74d9d3d19ffa3dd"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-07T16:17:51.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-b915cdc4decc49fddab0add702e89d98"},{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"0.454%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.39409. Missing scores are unknown.","source_id":"sr-1f253ef07d2bed67c74d9d3d19ffa3dd"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b915cdc4decc49fddab0add702e89d98","url":"https://github.com/advisories/GHSA-4v53-57pg-c464","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-4v53-57pg-c464","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:46.232Z"},{"id":"sr-1f253ef07d2bed67c74d9d3d19ffa3dd","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-106452","publisher":"FIRST EPSS","observed_at":"2026-11-01T01:39:43.064Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b915cdc4decc49fddab0add702e89d98"],"technology":"at.yawk.lz4:lz4-java","known_exclusions":[],"conditions_summary":"### Summary\n\n`LZ4BlockInputStream` grows its compressed-input buffer to the attacker-controlled `compressedLen` value from the legacy `LZ4Block` stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream`, `refill()` validates that `compressedLen` is nonnegative but does not cap it before allocation:\n\n```java\ncase COMPRESSION_METHOD_LZ4:\n  if (compressedBuffer.length = o) {\n  compressMethod = COMPRESSION_METHOD_RAW;\n  compressedLength = o;\n} else {\n  compressMethod = COMPRESSION_METHOD_LZ4;\n}\n```\n\nExisting readers generally accept noncanonical LZ4-method blocks where `compressedLen >= originalLen`, but no canonical writer found produces them.\n\n### Impact\n\nApplications that pass attacker-controlled legacy `LZ4Block` s","public_affected_ranges":["<= 1.11.1"]},{"certainty":"source_listed","source_ids":["sr-b915cdc4decc49fddab0add702e89d98"],"technology":"org.lz4:lz4-java","known_exclusions":[],"conditions_summary":"### Summary\n\n`LZ4BlockInputStream` grows its compressed-input buffer to the attacker-controlled `compressedLen` value from the legacy `LZ4Block` stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream`, `refill()` validates that `compressedLen` is nonnegative but does not cap it before allocation:\n\n```java\ncase COMPRESSION_METHOD_LZ4:\n  if (compressedBuffer.length = o) {\n  compressMethod = COMPRESSION_METHOD_RAW;\n  compressedLength = o;\n} else {\n  compressMethod = COMPRESSION_METHOD_LZ4;\n}\n```\n\nExisting readers generally accept noncanonical LZ4-method blocks where `compressedLen >= originalLen`, but no canonical writer found produces them.\n\n### Impact\n\nApplications that pass attacker-controlled legacy `LZ4Block` s","public_affected_ranges":["<= 1.8.1"]}],"null_published_at":"2026-11-01T14:34:14.102Z","source_updated_at":"2026-10-07T16:17:51.000Z","source_disclosed_at":"2026-10-07T16:17:50.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T00:58:46.232Z"},{"id":"NVI-00012153","kind":"vulnerability","title":"yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4v53-57pg-c464","CVE-2026-106452"],"plain_summary":"GitHub lists this reviewed advisory for at.yawk.lz4:lz4-java, org.lz4:lz4-java. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-b915cdc4decc49fddab0add702e89d98"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-07T16:17:51.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-b915cdc4decc49fddab0add702e89d98"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-b915cdc4decc49fddab0add702e89d98","url":"https://github.com/advisories/GHSA-4v53-57pg-c464","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-4v53-57pg-c464","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T00:58:46.232Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-b915cdc4decc49fddab0add702e89d98"],"technology":"at.yawk.lz4:lz4-java","known_exclusions":[],"conditions_summary":"### Summary\n\n`LZ4BlockInputStream` grows its compressed-input buffer to the attacker-controlled `compressedLen` value from the legacy `LZ4Block` stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream`, `refill()` validates that `compressedLen` is nonnegative but does not cap it before allocation:\n\n```java\ncase COMPRESSION_METHOD_LZ4:\n  if (compressedBuffer.length = o) {\n  compressMethod = COMPRESSION_METHOD_RAW;\n  compressedLength = o;\n} else {\n  compressMethod = COMPRESSION_METHOD_LZ4;\n}\n```\n\nExisting readers generally accept noncanonical LZ4-method blocks where `compressedLen >= originalLen`, but no canonical writer found produces them.\n\n### Impact\n\nApplications that pass attacker-controlled legacy `LZ4Block` s","public_affected_ranges":["<= 1.11.1"]},{"certainty":"source_listed","source_ids":["sr-b915cdc4decc49fddab0add702e89d98"],"technology":"org.lz4:lz4-java","known_exclusions":[],"conditions_summary":"### Summary\n\n`LZ4BlockInputStream` grows its compressed-input buffer to the attacker-controlled `compressedLen` value from the legacy `LZ4Block` stream header before reading any payload bytes. A header-only input can therefore trigger a near-2 GiB allocation and exhaust the JVM heap.\n\n### Details\n\nIn `net.jpountz.lz4.LZ4BlockInputStream`, `refill()` validates that `compressedLen` is nonnegative but does not cap it before allocation:\n\n```java\ncase COMPRESSION_METHOD_LZ4:\n  if (compressedBuffer.length = o) {\n  compressMethod = COMPRESSION_METHOD_RAW;\n  compressedLength = o;\n} else {\n  compressMethod = COMPRESSION_METHOD_LZ4;\n}\n```\n\nExisting readers generally accept noncanonical LZ4-method blocks where `compressedLen >= originalLen`, but no canonical writer found produces them.\n\n### Impact\n\nApplications that pass attacker-controlled legacy `LZ4Block` s","public_affected_ranges":["<= 1.8.1"]}],"null_published_at":"2026-11-01T01:04:01.248Z","source_updated_at":"2026-10-07T16:17:51.000Z","source_disclosed_at":"2026-10-07T16:17:50.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T00:58:46.232Z"}],"next_cursor":null,"snapshot_revision":"42594"}