REDHAT-BUG-2417718: Medium severity maven/org.lz4/lz4-java vulnerability

Q: What input path must be exposed for this issue to be exploitable?

An application must process untrusted compressed input using org.lz4:lz4-java. Remote attackers can use that input to trigger denial of service or potentially read adjacent memory.

Q: Which lz4-java versions are affected?

Version 1.8.0 and earlier are affected.

Q: How can I determine whether my application may be exposed?

Check Maven dependencies, including transitive dependencies, for org.lz4:lz4-java at version 1.8.0 or earlier. Then identify whether the application decompresses data supplied by remote or otherwise untrusted sources.

Q: What should be prioritized if patching cannot happen immediately?

Prioritize preventing untrusted compressed input from reaching lz4-java decompression paths, especially in remotely accessible services. The provided information does not specify an alternative mitigation.

Published Nov 28, 2025

Updated

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Affected Software

1 affected component

maven/org.lz4/lz4-java<=1.8.0

Event History

Nov 28, 2025

Data Sourced

via Red Hat·04:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What input path must be exposed for this issue to be exploitable?

An application must process untrusted compressed input using org.lz4:lz4-java. Remote attackers can use that input to trigger denial of service or potentially read adjacent memory.

Which lz4-java versions are affected?

Version 1.8.0 and earlier are affected.

How can I determine whether my application may be exposed?

Check Maven dependencies, including transitive dependencies, for org.lz4:lz4-java at version 1.8.0 or earlier. Then identify whether the application decompresses data supplied by remote or otherwise untrusted sources.

What should be prioritized if patching cannot happen immediately?

Prioritize preventing untrusted compressed input from reaching lz4-java decompression paths, especially in remotely accessible services. The provided information does not specify an alternative mitigation.

REDHAT-BUG-2417718: Medium severity maven/org.lz4/lz4-java vulnerability

Affected Software

Event History

Frequently Asked Questions

What input path must be exposed for this issue to be exploitable?

Which lz4-java versions are affected?

How can I determine whether my application may be exposed?

What should be prioritized if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

What input path must be exposed for this issue to be exploitable?

Which lz4-java versions are affected?

How can I determine whether my application may be exposed?

What should be prioritized if patching cannot happen immediately?