yawkat LZ4 Java has a possible information leak in Java safe decompressor

published 2025-12-05 11 mo ago modified 2026-09-25 44 d ago also GHSA-cmp6-m4wj-q63q , EUVD-2025-201456

cvss: 8.2; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 51%
public exploits: 0; none known

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.

Patch / fix

fixed in 1 distros 4 links 1

maven at.yawk.lz4:lz4-java 1.10.1

debian red hat almalinux rocky linux

lz4-java Debian 14 1.11.2+ds1-1

debian advisories DEBIAN-CVE-2025-66566

jmc RHEL 9 8.2.0-19.el9_8.2
eap8-wildfly jboss enterprise application platform 8.1 8.1.4-2.GA_redhat_00005.1.el9eap
eap8-wildfly-modules jboss enterprise application platform 8.1 8.1.4-2.GA_redhat_00005.1.el9eap
eap8-wildfly-java-jdk17 jboss enterprise application platform 8.1 8.1.4-2.GA_redhat_00005.1.el9eap
eap8-wildfly-java-jdk21 jboss enterprise application platform 8.1 8.1.4-2.GA_redhat_00005.1.el9eap
eap8-wildfly jboss enterprise application platform 8.1 8.1.4-2.GA_redhat_00005.1.el8eap
eap8-wildfly-modules jboss enterprise application platform 8.1 8.1.4-2.GA_redhat_00005.1.el8eap
eap8-wildfly-java-jdk17 jboss enterprise application platform 8.1 8.1.4-2.GA_redhat_00005.1.el8eap

red hat advisories RHSA-2026:20568 RHSA-2026:1871 RHSA-2026:1870 RHSA-2026:1823 RHSA-2026:0751 RHSA-2026:0752

jmc AlmaLinux 9 8.2.0-19.el9_8.2
jmc AlmaLinux 9 8.2.0-18.el9_7.2

almalinux advisories ALSA-2026:20568 ALSA-2026:0752

jmc Rocky Linux 9 8.2.0-19.el9_8.2
jmc Rocky Linux 9 8.2.0-18.el9_7.2

rocky linux advisories RLSA-2026:20568 RLSA-2026:0752

github.com/yawkat/lz4-java@33d180c commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-66566 updated 2026-11-04 cvss 7.5

lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing

Red Hat Logging Subsystem for Red Hat OpenShift lz4-java
affected: no fix planned “Will not fix”
Red Hat build of Apache Camel - HawtIO 4 lz4-java Red Hat build of Apache Camel 4 for Quarkus 3 lz4-java
affected: no fix available
Red Hat build of Apicurio Registry 2 lz4-java
affected: no fix planned “Will not fix”
Red Hat build of Apicurio Registry 3 lz4-java
affected: no fix available
Red Hat build of Debezium 2 lz4-java Red Hat build of Debezium 3 lz4-java
affected: no fix planned “Will not fix”
Red Hat Enterprise Linux 8 lz4-java, lz4-java-javadoc
affected: no fix available
Red Hat Fuse 7 lz4-java
affected: no fix planned “Will not fix”
Red Hat JBoss Enterprise Application Platform Expansion Pack lz4-java
affected: no fix available

show 17 more

Red Hat Process Automation 7 lz4-java
affected: no fix planned “Will not fix”
Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-rhel9 4.1.0-16, cryostat/jfr-datasource-rhel9 4.1.0-16, cryostat/cryostat-reports-rhel9 4.1.0-16
fixed: vendor fix RHSA-2026:0761
Red Hat Build of Apache Camel 4.10 for Quarkus 3.20
fixed: vendor fix RHSA-2026:0467
Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
fixed: vendor fix RHSA-2026:0468
Red Hat build of Apache Camel 4.14.2.P1 for Spring Boot 3.5.9
fixed: vendor fix RHSA-2026:0726
Red Hat build of Quarkus 3.20.4.SP1
fixed: vendor fix RHSA-2026:0131
Red Hat build of Quarkus 3.27.1.SP1
fixed: vendor fix RHSA-2026:0134
Red Hat CodeReady Linux Builder EUS (v.9.4) jmc 8.2.0-17.el9_4.2
fixed: vendor fix RHSA-2026:1823
Red Hat CodeReady Linux Builder EUS (v.9.6) jmc 8.2.0-18.el9_6.2
fixed: vendor fix RHSA-2026:0751
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) jmc 8.2.0-18.el9_7.2, jmc 8.2.0-19.el9_8.2
fixed: vendor fix RHSA-2026:0752
Red Hat JBoss EAP XP 5.0 Update 4.0
fixed: vendor fix RHSA-2026:3951
Red Hat JBoss Enterprise Application Platform 6.0.2 lz4-java 1.8.0.redhat-00010
fixed: vendor fix RHSA-2026:1935
Red Hat Cryostat 4 on RHEL 9 cryostat/cryostat-db-rhel9 4.1.0-21, cryostat/cryostat-storage-rhel9 4.1.0-21, cryostat/cryostat-rhel9-operator 4.1.0-21, cryostat/cryostat-operator-bundle 4.1.0-16, cryostat/cryostat-agent-init-rhel9 0.6.0-16, cryostat/cryostat-grafana-dashboard-rhel9 4.1.0-16, +1 more
not affected: vulnerable code not present
Red Hat Data Grid 8 lz4-java
not affected: component not present
Red Hat JBoss Enterprise Application Platform 6.0.2 pom.xml, liblz4-java.so, libsnappyjava.so, commons-logging 1.2, wc-chatbot-0.1.2.jar, commons-beanutils 1.9.4, +254 more Red Hat JBoss Enterprise Application Platform 7 lz4-java Red Hat JBoss Enterprise Application Platform 8 lz4-java
not affected: vulnerable code not present
Red Hat JBoss Web Server 6 lz4-java
not affected: component not present
Red Hat streams for Apache Kafka 3 lz4-java
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 11 mo ago (2025-12-05)

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA	4.0	8.2	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem	package	affected	fixed in
maven	at.yawk.lz4:lz4-java	<1.10.1	1.10.1
maven	org.lz4:lz4-java	<=1.8.1	no fix listed
maven	org.lz4:lz4-pure-java	<=1.8.1	no fix listed
maven	net.jpountz.lz4:lz4	<=1.8.1	no fix listed

Affected products

yawkat lz4-java

Classification

Weakness

CWE-201 Insertion of Sensitive Information Into Sent Data

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary