CVE-2026-106451 · GHSA-mcr4-qmvw-px4g
yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user
- Risk score
- 49/100
- CVSS
- 7.3 v4.0
- Exploit chance (30 days)
- 0.1%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowi…
- Affected
- at.yawk.lz4:lz4-java (maven) <= 1.11.3; org.lz4:lz4-java (maven) >= 1.7.0, <= 1.8.1
- Fix
- Upgrade at.yawk.lz4:lz4-java to 1.11.4 or later.
- Exploitation
- No known exploitation
Story map
At a glance
at.yawk.lz4:lz4-java: Yellow, plan it in. yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowi…
The flaws
- CVE-2026-106451: Yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user (CVSS 7.3 · EPSS 0%)
- CVE-2026-106450: Yawkat LZ4 Java: LZ4FrameInputStream reallocates block buffers for every frame, allowing CPU and GC amplification from small inputs (CVSS 5.3 · EPSS 0%)
- CVE-2026-106452: Yawkat LZ4 Java: LZ4BlockInputStream allocates an unvalidated compressed length from the stream header (CVSS 5.3 · EPSS 0%)
- CVE-2026-106453: Yawkat LZ4 Java: LZ4DecompressorWithLength allocates the unvalidated size from the 4-byte length header, so a 5-byte input triggers a 1 GiB allocation and OutOfMemoryError (CVSS 5.3 · EPSS 0%)
The fix
Upgrade at.yawk.lz4:lz4-java: 1.11.4 · 1.11.2 or later on your release line
Who is exposed: at.yawk.lz4:lz4-java (maven) <= 1.11.3; org.lz4:lz4-java (maven) >= 1.7.0, <= 1.8.1
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-367 (CWE-367). 47 other warnings in 30 days
Why it is Yellow
- CVSS 7.3 high
- On your watchlist: Maven
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| at.yawk.lz4:lz4-java | maven | <= 1.11.3 | 1.11.4 |
| org.lz4:lz4-java | maven | >= 1.7.0, <= 1.8.1 | No fix yet |
References
- https://github.com/advisories/GHSA-mcr4-qmvw-px4g
- https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g
- https://nvd.nist.gov/vuln/detail/CVE-2026-106451
- https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3
- https://github.com/yawkat/lz4-java/releases/tag/v1.11.4
- https://github.com/advisories/GHSA-mcr4-qmvw-px4g
Original description
yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load() uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without exclusive creation, allowing another local user with access to the same shared temporary directory to create or replace the library file before System.load() uses it. Successful exploitation depends on shared-directory permissions, host protections, and winning the race, and can execute native code as the victim; hardened systems may instead cause library loading to fail and fall back to Java implementations. Configurations using a system library, a private java.io.tmpdir, or Java-only implementations are not affected. This issue is fixed in version 1.11.4.
Last activity 6 Oct 2026. Patch Forecast updates every hour.