Listen to this Post
The vulnerability resides within the `net.jpountz.lz4.LZ4DecompressorWithLength` convenience class in the `lz4-java` library. When applications decompress data streams or payloads using LZ4DecompressorWithLength.decompress(byte[], int), the method reads an initial four-byte integer header from the source buffer. This integer value represents the expected decompressed length of the payload (destLen).
Immediately upon extracting `destLen` via getDecompressedLength(src, srcOff), the decompressive routine invokes fastDecompressor.decompress(src, srcOff + 4, destLen). The `LZ4FastDecompressor` implementation directly allocates a new Java byte array in heap memory using `new byte
` prior to executing any decompression logic or validating the integrity of the remaining compressed bytes. Because `getDecompressedLength` performs no validation against <code>src.length</code>, enforces no upper allocation bounds, and permits large positive integer values, an attacker can supply a minimal payload containing a manipulated 4-byte header. For instance, sending a 5-byte payload where the first four bytes encode `0x40000000` forces the Java Virtual Machine (JVM) to immediately attempt a 1 GiB memory allocation on the heap. The root cause stems from trusting user-controlled metadata to allocate memory resources before verifying whether sufficient compressed data exists to produce that decompressed output. In contrast, the direct buffer overloads—where callers supply an existing byte array destination—do not suffer from this behavior because array sizing is controlled by the application logic rather than input headers. When deployed on network services processing untrusted compressed request bodies, concurrent submission of small, specially framed payloads leads to rapid memory exhaustion. Multiple simultaneous allocations cause excessive Garbage Collection overhead and trigger `java.lang.OutOfMemoryError` exceptions, resulting in service denial without requiring authentication or privileges. <h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">DailyCVE Form:</h2> Platform: lz4-java library Version: Prior to 1.11.2 Vulnerability: Heap Allocation DoS Severity: Medium 5.3 CVSS date: October 6 2026 <h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Prediction: Patch available now</h2> <h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">What Undercode Say:</h2> <h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Analytics</h2> [bash] Check Java dependencies for affected lz4-java versions mvn dependency:tree | grep -i "lz4" Audit Gradle builds for lz4-java versions below 1.11.2 gradle dependencies | grep -i "lz4-java"
// Vulnerable API usage pattern in net.jpountz.lz4
public byte[] decompressUntrustedData(byte[] input) {
// Vulnerable overload: Reads 4-byte header and allocates new byte[bash] immediately
return LZ4DecompressorWithLength.INSTANCE.decompress(input, 0);
}
Exploit: (Educational Purposes!)
The conceptual mechanism relies on input header manipulation to trigger asymmetric memory allocation:
1. An attacker constructs a minimal byte array where the first 4 bytes represent an integer length header (e.g., `0x40000000` for 1 GiB) followed by 1 dummy compressed byte.
2. The payload is transmitted over a network connection to an endpoint that passes incoming request streams directly into LZ4DecompressorWithLength.decompress(src, off).
3. The server thread reads the header and immediately allocates a 1 GiB `byte[]` array on the JVM heap before attempting decompression.
4. Sending several concurrent requests exhausts the JVM heap pool, triggering GC thrashing and eventual `java.lang.OutOfMemoryError` crashes.
Protection: from this CVE
- Upgrade `lz4-java` to version 1.11.2 or later where length header bounds checking and input validation are implemented.
- Replace `LZ4DecompressorWithLength` convenience calls with fixed-size caller-allocated buffers using
decompress(src, srcOff, dest, destOff, maxDestLen). - Enforce maximum request size limits and rate limiting at ingress proxies or API gateways to restrict untrusted compressed payload execution.
Impact:
Remote unauthenticated attackers can cause Denial of Service (DoS) through JVM heap exhaustion using minimal network bandwidth. Confidentiality and system integrity remain unaffected.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
