{"id":"CVE-2025-66566","title":"yawkat LZ4 Java provides LZ4 compression for Java","summary":"yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted …","severity":"high","cwe":["CWE-201","CWE-908"],"published":"2025-12-05","updated":"2026-09-25","sourceUpdated":"2026-09-25T23:10:00.463","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66566","references":[{"url":"https://github.com/yawkat/lz4-java/commit/33d180cb70c4d93c80fb0dc3ab3002f457e93840","label":"security-advisories@github.com"},{"url":"https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-66566.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-66566"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2419500"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-66566"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66566"},{"url":"https://access.redhat.com/errata/RHSA-2026:0761"},{"url":"https://access.redhat.com/errata/RHSA-2026:1823"},{"url":"https://access.redhat.com/errata/RHSA-2026:0751"},{"url":"https://access.redhat.com/errata/RHSA-2026:0752"},{"url":"https://access.redhat.com/errata/RHSA-2026:20568"},{"url":"https://access.redhat.com/errata/RHSA-2026:0467"},{"url":"https://access.redhat.com/errata/RHSA-2026:0468"},{"url":"https://access.redhat.com/errata/RHSA-2026:3951"},{"url":"https://access.redhat.com/errata/RHSA-2026:1935"},{"url":"https://access.redhat.com/errata/RHSA-2026:0726"},{"url":"https://access.redhat.com/errata/RHSA-2026:0131"},{"url":"https://access.redhat.com/errata/RHSA-2026:0134"}],"tags":["nvd","csaf","vex","red-hat"],"epss":0.00605,"epssPercentile":0.48755,"ingestedAt":"2026-09-25T23:21:16.898Z","vendor":"Red Hat","product":"Cryostat 4 on RHEL 9","affected":["logging_subsystem_for_red_hat_openshift","build_of_apache_camel_hawtio 4","build_of_apache_camel_4_for_quarkus 3","build_of_apicurio_registry 2","build_of_apicurio_registry 3","build_of_debezium 2","build_of_debezium 3","enterprise_linux 8","fuse 7","jboss_enterprise_application_platform_expansion_pack","process_automation 7","cryostat_4_on_rhel 9","codeready_linux_builder_eus_v_9_4","codeready_linux_builder_eus_v_9_6","enterprise_linux_codeready_linux_builder_v_9","build_of_apache_camel_4_10_for_quarkus 3.20","build_of_apache_camel_4_14_for_quarkus 3.27","jboss_eap_xp_5_0_update 4.0","jboss_enterprise_application_platform 6.0.2","build_of_apache_camel_4_14_2_p1_for_spring_boot 3.5.9","build_of_quarkus 3.20.4.SP1","build_of_quarkus 3.27.1.SP1"],"patched":["cryostat_4_on_rhel 9","codeready_linux_builder_eus_v_9_4","codeready_linux_builder_eus_v_9_6","enterprise_linux_codeready_linux_builder_v_9","build_of_apache_camel_4_10_for_quarkus 3.20","build_of_apache_camel_4_14_for_quarkus 3.27","jboss_eap_xp_5_0_update 4.0","jboss_enterprise_application_platform 6.0.2","build_of_apache_camel_4_14_2_p1_for_spring_boot 3.5.9","build_of_quarkus 3.20.4.SP1","build_of_quarkus 3.27.1.SP1"],"cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","slug":"CVE-2025-66566","body":"## Overview\n\nyawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:0761** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-01-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:0761)\n- **RHSA-2026:1823** · Red Hat · fixed in: Red Hat CodeReady Linux Builder EUS (v.9.4) · released 2026-02-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:1823)\n- **RHSA-2026:0751** · Red Hat · fixed in: Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-01-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:0751)\n- **RHSA-2026:0752** · Red Hat · fixed in: Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-01-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:0752)\n- **RHSA-2026:20568** · Red Hat · fixed in: Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20568)\n- **RHSA-2026:0467** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 · released 2026-01-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:0467)\n- **RHSA-2026:0468** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 · released 2026-01-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:0468)\n- **RHSA-2026:3951** · Red Hat · fixed in: Red Hat JBoss EAP XP 5.0 Update 4.0 · released 2026-03-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:3951)\n- **RHSA-2026:1935** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 6.0.2 · released 2026-02-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:1935)\n- **RHSA-2026:0726** · Red Hat · fixed in: Red Hat build of Apache Camel 4.14.2.P1 for Spring Boot 3.5.9 · released 2026-01-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:0726)\n- **RHSA-2026:0131** · Red Hat · fixed in: Red Hat build of Quarkus 3.20.4.SP1 · released 2026-01-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:0131)\n- **Red Hat VEX** · Important · affected: Logging Subsystem for Red Hat OpenShift, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 2, … · no fix planned: Logging Subsystem for Red Hat OpenShift, Red Hat build of Apicurio Registry 2, Red Hat build of Debezium 2, Red Hat build of Debezium 3, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-66566.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":225741,"id":"CVE-2025-66566","ts":1792498417323,"field":"cvss","old":null,"new":"7.5"},{"seq":225740,"id":"CVE-2025-66566","ts":1792498417323,"field":"severity","old":"none","new":"high"}]}