--- id: CVE-2025-66566 title: yawkat LZ4 Java provides LZ4 compression for Java summary: >- yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted … severity: high cwe: - CWE-201 - CWE-908 published: '2025-12-05' updated: '2026-09-25' sourceUpdated: '2026-09-25T23:10:00.463' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66566' references: - url: >- https://github.com/yawkat/lz4-java/commit/33d180cb70c4d93c80fb0dc3ab3002f457e93840 label: security-advisories@github.com - url: 'https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q' label: security-advisories@github.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-66566.json - url: 'https://access.redhat.com/security/cve/CVE-2025-66566' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2419500' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-66566' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66566' - url: 'https://access.redhat.com/errata/RHSA-2026:0761' - url: 'https://access.redhat.com/errata/RHSA-2026:1823' - url: 'https://access.redhat.com/errata/RHSA-2026:0751' - url: 'https://access.redhat.com/errata/RHSA-2026:0752' - url: 'https://access.redhat.com/errata/RHSA-2026:20568' - url: 'https://access.redhat.com/errata/RHSA-2026:0467' - url: 'https://access.redhat.com/errata/RHSA-2026:0468' - url: 'https://access.redhat.com/errata/RHSA-2026:3951' - url: 'https://access.redhat.com/errata/RHSA-2026:1935' - url: 'https://access.redhat.com/errata/RHSA-2026:0726' - url: 'https://access.redhat.com/errata/RHSA-2026:0131' - url: 'https://access.redhat.com/errata/RHSA-2026:0134' tags: - nvd - csaf - vex - red-hat epss: 0.00605 epssPercentile: 0.48755 ingestedAt: '2026-09-25T23:21:16.898Z' vendor: Red Hat product: Cryostat 4 on RHEL 9 affected: - logging_subsystem_for_red_hat_openshift - build_of_apache_camel_hawtio 4 - build_of_apache_camel_4_for_quarkus 3 - build_of_apicurio_registry 2 - build_of_apicurio_registry 3 - build_of_debezium 2 - build_of_debezium 3 - enterprise_linux 8 - fuse 7 - jboss_enterprise_application_platform_expansion_pack - process_automation 7 - cryostat_4_on_rhel 9 - codeready_linux_builder_eus_v_9_4 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_codeready_linux_builder_v_9 - build_of_apache_camel_4_10_for_quarkus 3.20 - build_of_apache_camel_4_14_for_quarkus 3.27 - jboss_eap_xp_5_0_update 4.0 - jboss_enterprise_application_platform 6.0.2 - build_of_apache_camel_4_14_2_p1_for_spring_boot 3.5.9 - build_of_quarkus 3.20.4.SP1 - build_of_quarkus 3.27.1.SP1 patched: - cryostat_4_on_rhel 9 - codeready_linux_builder_eus_v_9_4 - codeready_linux_builder_eus_v_9_6 - enterprise_linux_codeready_linux_builder_v_9 - build_of_apache_camel_4_10_for_quarkus 3.20 - build_of_apache_camel_4_14_for_quarkus 3.27 - jboss_eap_xp_5_0_update 4.0 - jboss_enterprise_application_platform 6.0.2 - build_of_apache_camel_4_14_2_p1_for_spring_boot 3.5.9 - build_of_quarkus 3.20.4.SP1 - build_of_quarkus 3.27.1.SP1 cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N' cvssSource: vendor --- ## Overview yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:0761** · Red Hat · fixed in: Cryostat 4 on RHEL 9 · released 2026-01-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:0761) - **RHSA-2026:1823** · Red Hat · fixed in: Red Hat CodeReady Linux Builder EUS (v.9.4) · released 2026-02-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:1823) - **RHSA-2026:0751** · Red Hat · fixed in: Red Hat CodeReady Linux Builder EUS (v.9.6) · released 2026-01-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:0751) - **RHSA-2026:0752** · Red Hat · fixed in: Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-01-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:0752) - **RHSA-2026:20568** · Red Hat · fixed in: Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) · released 2026-05-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:20568) - **RHSA-2026:0467** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 · released 2026-01-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:0467) - **RHSA-2026:0468** · Red Hat · fixed in: Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 · released 2026-01-12 · [advisory](https://access.redhat.com/errata/RHSA-2026:0468) - **RHSA-2026:3951** · Red Hat · fixed in: Red Hat JBoss EAP XP 5.0 Update 4.0 · released 2026-03-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:3951) - **RHSA-2026:1935** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 6.0.2 · released 2026-02-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:1935) - **RHSA-2026:0726** · Red Hat · fixed in: Red Hat build of Apache Camel 4.14.2.P1 for Spring Boot 3.5.9 · released 2026-01-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:0726) - **RHSA-2026:0131** · Red Hat · fixed in: Red Hat build of Quarkus 3.20.4.SP1 · released 2026-01-06 · [advisory](https://access.redhat.com/errata/RHSA-2026:0131) - **Red Hat VEX** · Important · affected: Logging Subsystem for Red Hat OpenShift, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apicurio Registry 2, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 2, … · no fix planned: Logging Subsystem for Red Hat OpenShift, Red Hat build of Apicurio Registry 2, Red Hat build of Debezium 2, Red Hat build of Debezium 3, … · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-66566.json)