Read the docs
TI-2025-40977 Aliases CVE-2025-66566GHSA-cmp6-m4wj-q63q

yawkat LZ4 Java has a possible information leak in Java safe decompressor

Priority MEDIUM 43CWE-201Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 11 fixed, 11 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-201.

Summary

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00649 51st percentileScored 2026-11-07
Fix Partial lz4-java (yawkat): 1.10.1at.yawk.lz4:lz4-java (Maven): 1.10.1Red Hat: 15 advisoriesRed Hat: 11 fixed, 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
yawkatlz4-javabefore 1.10.11.10.1Patch availableCNA
—at.yawk.lz4:lz4-java (Maven)before 1.10.11.10.1Patch availableGHSA-cmp6-m4wj-q63q
—org.lz4:lz4-java (Maven)up to 1.8.1—No fix listedGHSA-cmp6-m4wj-q63q
—org.lz4:lz4-pure-java (Maven)up to 1.8.1—No fix listedGHSA-cmp6-m4wj-q63q
—net.jpountz.lz4:lz4 (Maven)up to 1.8.1—No fix listedGHSA-cmp6-m4wj-q63q
  • lz4-java Vendoryawkat Affected before 1.10.1 Fixed in 1.10.1 Patch available CNA
  • at.yawk.lz4:lz4-java (Maven) Vendor— Affected before 1.10.1 Fixed in 1.10.1 Patch available GHSA-cmp6-m4wj-q63q
  • org.lz4:lz4-java (Maven) Vendor— Affected up to 1.8.1 Fixed in — No fix listed GHSA-cmp6-m4wj-q63q
  • org.lz4:lz4-pure-java (Maven) Vendor— Affected up to 1.8.1 Fixed in — No fix listed GHSA-cmp6-m4wj-q63q
  • net.jpountz.lz4:lz4 (Maven) Vendor— Affected up to 1.8.1 Fixed in — No fix listed GHSA-cmp6-m4wj-q63q

Remediation

  • Fix · CNA lz4-java (yawkat) Fixed in 1.10.1
  • Fix · GHSA-cmp6-m4wj-q63q at.yawk.lz4:lz4-java (Maven) Fixed in 1.10.1 Advisory →

Red Hat 15 advisories

  • RHSA-2026:20568 Released 2026-05-26 · Red Hat rating Important
    jmc security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) jmc-8.2.0-19.el9_8.2
  • RHSA-2026:3951 Released 2026-03-05 · Red Hat rating Important
    JBoss EAP XP 5.0 Update 4.0 release. See references for release notes.
    • Red Hat JBoss EAP XP 5.0 Update 4.0
  • RHSA-2026:1935 Released 2026-02-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.4 XP 6.0.2.GA release
    • Red Hat JBoss Enterprise Application Platform 6.0.2 org.lz4.lz4-java-1.8.0.redhat-00010.jar
Show 12 more Red Hat advisories
  • RHSA-2026:1870 Released 2026-02-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.4 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-wildfly-8.1.4-2.GA_redhat_00005.1.el8eap, eap8-wildfly-java-jdk17-8.1.4-2.GA_redhat_00005.1.el8eap, eap8-wildfly-java-jdk21-8.1.4-2.GA_redhat_00005.1.el8eap +1
  • RHSA-2026:1871 Released 2026-02-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.4 security update
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-wildfly-8.1.4-2.GA_redhat_00005.1.el9eap, eap8-wildfly-java-jdk17-8.1.4-2.GA_redhat_00005.1.el9eap, eap8-wildfly-java-jdk21-8.1.4-2.GA_redhat_00005.1.el9eap +1
  • RHSA-2026:1872 Released 2026-02-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.4 security update
    • Red Hat JBoss Enterprise Application Platform 8.1
  • RHSA-2026:1823 Released 2026-02-03 · Red Hat rating Important
    JMC bug fix and enhancement update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) jmc-8.2.0-17.el9_4.2
  • RHSA-2026:0761 Released 2026-01-19 · Red Hat rating Important
    Red Hat build of Cryostat security update
    • Cryostat 4 on RHEL 9 cryostat/cryostat-openshift-console-plugin-rhel9, cryostat/cryostat-reports-rhel9, cryostat/cryostat-rhel9 +1
  • RHSA-2026:0752 Released 2026-01-19 · Red Hat rating Important
    jmc security update
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) jmc-8.2.0-18.el9_7.2
  • RHSA-2026:0751 Released 2026-01-19 · Red Hat rating Important
    jmc security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) jmc-8.2.0-18.el9_6.2
  • RHSA-2026:0726 Released 2026-01-15 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.14.2.P1 for Spring Boot release.
    • Red Hat build of Apache Camel 4.14.2.P1 for Spring Boot 3.5.9
  • RHSA-2026:0468 Released 2026-01-12 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.14 for Quarkus 3.27 update is now available (RHBQ 3.27.1.SP1)
    • Red Hat Build of Apache Camel 4.14 for Quarkus 3.27
  • RHSA-2026:0467 Released 2026-01-12 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 update is now available (RHBQ 3.20.4.SP1)
    • Red Hat Build of Apache Camel 4.10 for Quarkus 3.20
  • RHSA-2026:0134 Released 2026-01-06 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.1.SP1 security update
    • Red Hat build of Quarkus 3.27.1.SP1
  • RHSA-2026:0131 Released 2026-01-06 · Red Hat rating Important
    Red Hat build of Quarkus 3.20.4.SP1 security update
    • Red Hat build of Quarkus 3.20.4.SP1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apicurio Registry 2AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Will not fix
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Cryostat 4 on RHEL 9Fixed RHSA-2026:0761
Red Hat Build of Apache Camel 4.10 for Quarkus 3.20Fixed RHSA-2026:0467
Red Hat Build of Apache Camel 4.14 for Quarkus 3.27Fixed RHSA-2026:0468
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:1823
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:0751
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:0752, RHSA-2026:20568
Red Hat JBoss EAP XP 5.0 Update 4.0Fixed RHSA-2026:3951
Red Hat JBoss Enterprise Application Platform 6.0.2Fixed RHSA-2026:1935
Red Hat build of Apache Camel 4.14.2.P1 for Spring Boot 3.5.9Fixed RHSA-2026:0726
Red Hat build of Quarkus 3.20.4.SP1Fixed RHSA-2026:0131
Red Hat build of Quarkus 3.27.1.SP1Fixed RHSA-2026:0134
Not affected: 7 products
  • Cryostat 4 on RHEL 9
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform 6.0.2
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Web Server 6
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66566
  2. 2026-10-03 Alias added: GHSA-cmp6-m4wj-q63q
  3. 2026-10-06 Affected versions changed · Red Hat
  4. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 6.0.2 · Red Hat
  5. 2026-11-05 EPSS moved to the 50th–90th percentile

References

Advisory 1

Other 3

  • TI-2026-68931 LZ4 Java native library extraction allows local file replacement CVSS 4.0HIGH 7.3
  • TI-2026-68933 LZ4 Java decompressor allocates memory from untrusted length header CVSS 3.1MEDIUM 5.3
  • TI-2026-68932 Excessive memory allocation in LZ4 Java stream reader CVSS 3.1MEDIUM 5.3
  • TI-2026-68930 LZ4 Java LZ4FrameInputStream allocates memory without limits CVSS 3.1MEDIUM 5.3
  • TI-2026-42755 NULL pointer dereference in yawkat lz4-java CVSS 3.1MEDIUM 6.5
  • TI-2026-68929 Uncontrolled recursion in yawkat LZ4 Java LZ4BlockInputStream CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences