https://seclists.org/oss-sec/2025/q4/248: CVE-2025-66566 fixed in lz4-java 1.10.1

Q: Which deployments are exposed to the information disclosure?

Deployments using the Java-based decompressor implementations are exposed when they process attacker-controlled compressed input and reuse an output buffer without clearing it. JNI-based implementations are not affected.

Q: Which package coordinates have a patched release?

at.yawk.lz4:lz4-java is patched in version 1.10.1; versions 1.10.0 and earlier are affected. The advisory lists no patched version for net.jpountz.lz4:lz4, org.lz4:lz4-java, or org.lz4:lz4-pure-java, which are affected through 1.8.1.

Q: What can be done when upgrading is not immediately possible?

Avoid reusing decompression output buffers without clearing them, particularly where compressed input can be supplied by remote attackers. This addresses the condition under which prior buffer contents may be disclosed.

Published Dec 5, 2025

Updated

Affected Software

4 affected components

maven/at.yawk.lz4/lz4-java<=1.10.0

maven/net.jpountz.lz4/lz4<=1.8.1

maven/org.lz4/lz4-java<=1.8.1

maven/org.lz4/lz4-pure-java<=1.8.1

Frequently Asked Questions

Which deployments are exposed to the information disclosure?

Deployments using the Java-based decompressor implementations are exposed when they process attacker-controlled compressed input and reuse an output buffer without clearing it. JNI-based implementations are not affected.

Which package coordinates have a patched release?

at.yawk.lz4:lz4-java is patched in version 1.10.1; versions 1.10.0 and earlier are affected. The advisory lists no patched version for net.jpountz.lz4:lz4, org.lz4:lz4-java, or org.lz4:lz4-pure-java, which are affected through 1.8.1.

What can be done when upgrading is not immediately possible?

Avoid reusing decompression output buffers without clearing them, particularly where compressed input can be supplied by remote attackers. This addresses the condition under which prior buffer contents may be disclosed.