yawkat LZ4 Java has a possible information leak in Java safe decompressor

Summary Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lea...

Insertion of Sensitive Information Into Sent Data

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the decompression process when the output buffer is reused without being cleared. An...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15562 more potentially affected by CVE-2025-12183 +1 more via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2025-12183, CVE-2025-66566 Source advisory: SNYK:JAVA-ORGLZ4-14219384...

com.databricks:databricks-jdbc-thin (>=3.3.1, <=3.3.3), com.github.pjfanning:pekko-serialization-jackson3_2.12 (1.1.0) +50 more potentially affected by CVE-2025-66566 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.10.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =3.3.1, =3.9.0-rc5-p11, =3.10.1-dev-p17 - io.gitee.jiujiupin:fxu-framework 3.0.0 - io.gitee.jiujiupin:fxu-generator 1.3.2 - io.telicent.jena:jena-fuseki-kafka-module 2.3.1 - io.telicent.jena:jena-kafka-connector 2.3.1 -...

com.databricks:databricks-jdbc-thin (>=3.3.1, <=3.3.3), com.github.pjfanning:pekko-serialization-jackson3_2.12 (1.1.0) +50 more potentially affected by CVE-2025-66566 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.10.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =3.3.1, =3.9.0-rc5-p11, =3.10.1-dev-p17 - io.gitee.jiujiupin:fxu-framework 3.0.0 - io.gitee.jiujiupin:fxu-generator 1.3.2 - io.telicent.jena:jena-fuseki-kafka-module 2.3.1 - io.telicent.jena:jena-kafka-connector 2.3.1 -...

com.databricks:databricks-jdbc-thin (>=3.3.1, <=3.3.3), com.github.pjfanning:pekko-serialization-jackson3_2.12 (1.1.0) +50 more potentially affected by CVE-2025-12183 +1 more via at.yawk.lz4:lz4-java (>=1.8.1, <=1.10.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =3.3.1, =3.9.0-rc5-p11, =3.10.1-dev-p17 - io.gitee.jiujiupin:fxu-framework 3.0.0 - io.gitee.jiujiupin:fxu-generator 1.3.2 - io.telicent.jena:jena-fuseki-kafka-module 2.3.1 - io.telicent.jena:jena-kafka-connector 2.3.1 -...

CVE-2025-66566 yawkat LZ4 Java has a possible information leak in Java safe decompressor

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

CVE-2025-66566

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

CVE-2025-66566 yawkat LZ4 Java has a possible information leak in Java safe decompressor

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

CVE-2025-66566

CVE-2025-66566 affects yawkat LZ4 Java, including lz4-java 1.10.0 and earlier. The Java-based decompressor implementations fail to sufficiently clear the output buffer, enabling read-back of previously written data when processing crafted compressed input; JNI-based implementations are not affect...

EUVD-2025-201456

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

CVE-2025-66566 yawkat LZ4 Java has a possible information leak in Java safe decompressor

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

com.databricks:databricks-jdbc-thin (>=3.3.1, <=3.3.3), com.github.pjfanning:pekko-serialization-jackson3_2.12 (1.1.0) +50 more potentially affected by CVE-2025-66566 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.10.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =3.3.1, =3.9.0-rc5-p11, =3.10.1-dev-p17 - io.gitee.jiujiupin:fxu-framework 3.0.0 - io.gitee.jiujiupin:fxu-generator 1.3.2 - io.telicent.jena:jena-fuseki-kafka-module 2.3.1 - io.telicent.jena:jena-kafka-connector 2.3.1 -...

yawkat LZ4 Java has a possible information leak in Java safe decompressor

Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to...

LZ4 Java security vulnerabilities

LZ4 Java is a compression library for Java by the individual developer Jonas Konrad. A security vulnerability exists in LZ4 Java 1.10.0 and earlier versions, which stems from insufficient output buffer clearing and could lead to the disclosure of sensitive data...

CVE-2025-66566: Insertion of Sensitive Information Into Sent Data

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

lz4-java Heap Buffer Overflow Information Disclosure

The vulnerability of the LZ4decompressfast function in the lz4-java data compression library is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause service interruptions and expose sensitive information...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15542 more potentially affected by CVE-2025-12183 via org.lz4:lz4-java (>=1.4.0, <=1.8.0)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2025-12183 Source advisory: GHSA-VQF4-7M7X-WGFC...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15542 more potentially affected by CVE-2025-12183 via org.lz4:lz4-java (>=1.4.0, <=1.8.0)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2025-12183 Source advisory: OSV:GHSA-VQF4-7M7X-WGFC...

LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. This is fixed in a forked release: at.yawk.lz4:lz4-java version 1.8.1. The original project has been archived:...