GHSA-gm45-99xc-r7wv: Medium severity maven/org.lz4:lz4-java vulnerability

Summary

LZ4FrameInputStream allocates two new buffers of the frame's maximum block size, up to 4 MiB each, every time it reads a frame header. Because concatenated frames are read by default, an input made of many minimal empty frames forces about 8 MiB of zeroed heap allocation for every 11 input bytes.

Details

In net.jpountz.lz4.LZ4FrameInputStream.readHeader():

java maxBlockSize = frameInfo.getBD().getBlockMaximumSize(); compressedBuffer = new byte[maxBlockSize]; // Reused during different compressions rawBuffer = new byte[maxBlockSize]; buffer = ByteBuffer.wrap(rawBuffer);

This runs for every frame, and the previous frame's arrays are never reused. A valid 11-byte frame consists of the magic number, FLG 0x60, BD 0x70 (4 MiB blocks), the header checksum, and an immediate end mark. It carries no data, yet triggers the full 8 MiB allocation. new LZ4FrameInputStream(in) reads concatenated frames by default.

In local measurements on JDK 25, 10,000 such frames (110 KB of input) took about 8 seconds of CPU to read, roughly 70 seconds per MiB of input. This was similar under G1, Parallel, Serial and ZGC. A legitimate stream costs orders of magnitude less per input byte.

Impact

Applications that decode attacker-controlled LZ4 frame data with LZ4FrameInputStream can be made to spend large amounts of CPU and GC time relative to the input size. Live heap stays bounded at about 8 MiB and the stream produces no output, so decompressed-size limits do not help. Cost grows linearly with input size, so the practical limit is the compressed input size the application accepts. Availability impact only.

Applications using readSingleFrame = true perform only one allocation and are not affected.

Patch

Fixed in lz4-java 1.11.4. LZ4FrameInputStream now allocates its block buffers only when a block needs them and reuses them across frames, never shrinking them. The content checksum hash and the skippable-frame skip buffer are also reused instead of being created for every frame. Decompression is limited to the current frame's maximum block size.

For older versions, the workaround is to limit the compressed input size accepted from untrusted sources, or use single-frame mode where that is sufficient.