Linux Distros Unpatched Vulnerability : CVE-2025-12183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted...

com.databricks:databricks-jdbc-thin (>=3.3.1, <=3.3.3), com.github.pjfanning:pekko-serialization-jackson3_2.12 (1.1.0) +50 more potentially affected by CVE-2025-66566 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.10.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =3.3.1, =3.9.0-rc5-p11, =3.10.1-dev-p17 - io.gitee.jiujiupin:fxu-framework 3.0.0 - io.gitee.jiujiupin:fxu-generator 1.3.2 - io.telicent.jena:jena-fuseki-kafka-module 2.3.1 - io.telicent.jena:jena-kafka-connector 2.3.1 -...

yawkat LZ4 Java has a possible information leak in Java safe decompressor

Summary Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lea...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15543 more potentially affected by CVE-2025-66566 via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2025-66566 Source advisory: OSV:GHSA-CMP6-M4WJ-Q63Q...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15543 more potentially affected by CVE-2025-12183 +1 more via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2025-12183, CVE-2025-66566 Source advisory: SNYK:JAVA-ORGLZ4-14219384...

com.databricks:databricks-jdbc-thin (>=3.3.1, <=3.3.3), com.github.pjfanning:pekko-serialization-jackson3_2.12 (1.1.0) +50 more potentially affected by CVE-2025-12183 +1 more via at.yawk.lz4:lz4-java (>=1.8.1, <=1.10.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =3.3.1, =3.9.0-rc5-p11, =3.10.1-dev-p17 - io.gitee.jiujiupin:fxu-framework 3.0.0 - io.gitee.jiujiupin:fxu-generator 1.3.2 - io.telicent.jena:jena-fuseki-kafka-module 2.3.1 - io.telicent.jena:jena-kafka-connector 2.3.1 -...

com.databricks:databricks-jdbc-thin (>=3.3.1, <=3.3.3), com.github.pjfanning:pekko-serialization-jackson3_2.12 (1.1.0) +50 more potentially affected by CVE-2025-66566 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.10.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =3.3.1, =3.9.0-rc5-p11, =3.10.1-dev-p17 - io.gitee.jiujiupin:fxu-framework 3.0.0 - io.gitee.jiujiupin:fxu-generator 1.3.2 - io.telicent.jena:jena-fuseki-kafka-module 2.3.1 - io.telicent.jena:jena-kafka-connector 2.3.1 -...

Insertion of Sensitive Information Into Sent Data

Overview org.lz4:lz4-java is a Java port of the LZ4 compression algorithm and the xxHash hashing algorithm. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the decompression process when the output buffer is reused without being cleared. An...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +15543 more potentially affected by CVE-2025-66566 via org.lz4:lz4-java (>=1.4.0, <=1.8.1)

org.lz4:lz4-java MAVEN version =1.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2025-66566 Source advisory: GHSA-CMP6-M4WJ-Q63Q...

CVE-2025-66566 yawkat LZ4 Java has a possible information leak in Java safe decompressor

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

com.databricks:databricks-jdbc-thin (>=3.3.1, <=3.3.3), com.github.pjfanning:pekko-serialization-jackson3_2.12 (1.1.0) +50 more potentially affected by CVE-2025-66566 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.10.0)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =3.3.1, =3.9.0-rc5-p11, =3.10.1-dev-p17 - io.gitee.jiujiupin:fxu-framework 3.0.0 - io.gitee.jiujiupin:fxu-generator 1.3.2 - io.telicent.jena:jena-fuseki-kafka-module 2.3.1 - io.telicent.jena:jena-kafka-connector 2.3.1 -...

CVE-2025-66566

CVE-2025-66566 affects yawkat LZ4 Java, including lz4-java 1.10.0 and earlier. The Java-based decompressor implementations fail to sufficiently clear the output buffer, enabling read-back of previously written data when processing crafted compressed input; JNI-based implementations are not affect...

CVE-2025-66566 yawkat LZ4 Java has a possible information leak in Java safe decompressor

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

CVE-2025-66566 yawkat LZ4 Java has a possible information leak in Java safe decompressor

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

CVE-2025-66566

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

EUVD-2025-201456

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

LZ4 Java 安全漏洞

LZ4 Java is a compression library for Java by the individual developer Jonas Konrad. A security vulnerability exists in LZ4 Java 1.10.0 and earlier versions, which stems from insufficient output buffer clearing and could lead to the disclosure of sensitive data...

yawkat LZ4 Java has a possible information leak in Java safe decompressor

Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to...

CVE-2025-66566: Insertion of Sensitive Information Into Sent Data

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is...

The vulnerability of the LZ4_decompress_fast() function in the lz4-java data compression library allows a hacker to cause a service failure and disclose confidential information.

The vulnerability of the LZ4decompressfast function in the lz4-java data compression library is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a remote attacker to cause service interruptions and expose sensitive information...