CVE-2025-12183: lz4-java Out-of-bounds Read

CVSS: 8.8v4.0HighDeferred

AliasesUBUNTU-CVE-2025-12183DEBIAN-CVE-2025-12183CGA-2mjm-rrq2-c7q5+183 more

Published 28-11-2025Last modified 29-12-2025

Vulnerability summary

CVE-2025-12183 is a high (CVSS 8.8) Out-of-bounds Read vulnerability in lz4-java. EPSS estimates a 0.70% chance of exploitation in the next 30 days, higher than 52.1% of scored vulnerabilities.

Overall risk

35/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.8/10

010

High · v4.0 (CVE.org)

EPSS score

0.70%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

RHSA-2026:1870 RHSA-2026:1871 CGA-FFGJ-J23R-XF6F

Timeline

28-11-2025
PublishedVulnerability first disclosed.
29-12-2025
Last modifiedVulnerability information updated.

Description

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

CVSS metrics

7 scores · 7 sources · 1 version

v4.08.8

EPSS trend

Probability

0.70%

Chance of exploitation in the next 30 days

Percentile

52%

Versus all other CVEs

30-day change

0.00 pp

From 0.70% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.70%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.

Affected systems

Chainguard91 products

apache-hop< 2.17.0-r5
apache-hop-fips< 2.17.0-r5
cassandra-4.0< 4.0.19-r5
cassandra-4.1< 4.1.10-r5
cassandra-fips-4.0< 4.0.19-r4

cassandra-fips-4.1< 4.1.10-r4
cassandra-fips-5.0< 5.0.6-r5
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.18All versions (No fix recorded)
commercial-elasticsearch-9.0All versions (No fix recorded)
debezium-3.5-connector-jdbc< 3.5.1-r0
debezium-3.5-connector-mariadb< 3.5.1-r0
debezium-3.5-connector-mongodb< 3.5.1-r0
debezium-3.5-connector-mysql< 3.5.1-r0
debezium-3.5-connector-postgres< 3.5.1-r0
debezium-3.5-connector-sqlserver< 3.5.1-r0
debezium-connector-db2-3.5< 3.5.0-r1
debezium-connector-ibmi-3.5< 3.5.0-r1
debezium-connector-informix-3.5< 3.5.0-r1
debezium-connector-spanner-3.4< 3.4.2-r1
debezium-connector-spanner-3.5< 3.5.1-r1
debezium-connector-vitess-3.5< 3.5.1-r1
elasticsearch-7< 7.17.29-r12
elasticsearch-7-iamguarded< 7.17.29-r12
elasticsearch-8.17< 8.17.10-r21
elasticsearch-8.18All versions (No fix recorded)
elasticsearch-8.18-iamguardedAll versions (No fix recorded)
elasticsearch-9.0< 9.0.8-r10
elasticsearch-9.0-iamguarded< 9.0.8-r10
elasticsearch-fips-8.17< 8.17.10-r16
elasticsearch-fips-8.17-bitnami< 8.17.10-r16
elasticsearch-fips-8.18All versions (No fix recorded)
elasticsearch-fips-8.18-bitnamiAll versions (No fix recorded)
elasticsearch-fips-9.0< 9.0.8-r17
elasticsearch-fips-9.0-bitnami< 9.0.8-r17
hadoop-fips-3.3.6< 3.3.6-r26
hadoop-fips-3.4.2All versions (No fix recorded)
kafbat-ui< 1.5.0-r0
kafbat-ui-fips< 1.5.0-r0
kafka_exporter-strimzi-compat< 1.2.0-r5
kafka-3.7< 3.7.2-r53
kafka-3.8< 3.8.1-r52
kafka-4.0< 4.0.1-r8
kafka-4.1< 4.1.1-r7
kafka-fips-4.1< 4.1.1-r3
kafka-strimzi-compat< 1.2.0-r5
knative-kafka-broker-1.17-dispatcher-loom< 1.17.3-r6
knative-kafka-broker-1.17-receiver-loom< 1.17.3-r6
knative-kafka-broker-1.18-dispatcher-loom< 1.18.2-r1
knative-kafka-broker-1.18-receiver-loom< 1.18.2-r1
knative-kafka-broker-1.20-dispatcher-loom< 1.20.2-r2
knative-kafka-broker-1.20-receiver-loom< 1.20.2-r2
knative-kafka-broker-1.21-dispatcher-loom< 1.21.1-r1
knative-kafka-broker-1.21-receiver-loom< 1.21.1-r1
knative-kafka-broker-1.22-dispatcher-loom< 1.22.1-r1
knative-kafka-broker-1.22-receiver-loom< 1.22.1-r1
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.1-r1
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.1-r1
logstash-8.17< 8.17.10-r18
logstash-8.17-iamguarded-compat< 8.17.10-r18
logstash-8.17-with-output-opensearch< 8.17.10-r18
logstash-8.18All versions (No fix recorded)
logstash-8.18-iamguarded-compatAll versions (No fix recorded)
logstash-8.18-with-output-opensearchAll versions (No fix recorded)
logstash-8.19< 8.19.14-r3
logstash-8.19-iamguarded-compat< 8.19.14-r3
logstash-8.19-with-output-opensearch< 8.19.14-r3
logstash-9.0< 9.0.8-r17
logstash-9.0-iamguarded-compat< 9.0.8-r17
logstash-9.0-with-output-opensearch< 9.0.8-r17
opensearch-2-security< 2.19.4-r12
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
ranger< 2.9.0-r4 | < 2.9.0-r5
spark-3.5-scala-2.12< 3.5.8-r5
spark-3.5-scala-2.13< 3.5.8-r5
spark-4.0-scala-2.13< 4.0.2-r4
spark-4.1-scala-2.13< 4.1.1-r8
spark-fips-3.5-scala-2.12< 3.5.4-r24
spark-fips-3.5-scala-2.13< 3.5.4-r24
spark-fips-4.1-scala-2.13< 4.1.1-r5
strimzi-kafka-operator< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-cluster-operator< 1.2.0-r5
strimzi-kafka-operator-kafka-agent< 1.2.0-r5
strimzi-kafka-operator-kafka-baseAll versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-kafka-init< 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.2.0-r5 | < 0.51.0-r2
strimzi-kafka-operator-topic-operator< 1.2.0-r5
strimzi-kafka-operator-tracing-agent< 1.2.0-r5
strimzi-kafka-operator-user-operator< 1.2.0-r5
zipkin< 3.5.1-r13

Show all 91

Wolfi30 products

cassandra-4.1< 4.1.10-r5
debezium-3.5-connector-jdbc< 3.5.1-r0
debezium-3.5-connector-mariadb< 3.5.1-r0
debezium-3.5-connector-mongodb< 3.5.1-r0
debezium-3.5-connector-mysql< 3.5.1-r0

Show all 30

Org.lz42 products

lz4-java< 1.8.1
lz4-pure-java≤ 1.8.0

At.yawk.lz41 product

lz4-java< 1.8.1

Debian1 product

lz4-javaAll versions (No fix recorded) | < 1.11.2+ds1-1

Net.jpountz.lz41 product

lz4≤ 1.3.0

Opensuse1 product

grype&distro=openSUSE Tumbleweed< 0.109.1-1.1

Ubuntu1 product

lz4-javaAll versions (No fix recorded)

8 vendors · 128 products

References

13 links

www.sonatype.com/security-advisories/cve-2025-12183Third Party AdvisoryAdvisoryWEB
github.com/yawkat/lz4-java/releases/tag/v1.8.1PatchFIXWEB
www.openwall.com/lists/oss-security/2025/12/01/5WEB
ubuntu.com/security/CVE-2025-12183REPORT
www.cve.org/CVERecord?id=CVE-2025-12183REPORT
www.openwall.com/lists/oss-security/2025/12/01/5REPORT
security-tracker.debian.org/tracker/CVE-2025-12183Advisory
repo1.maven.org/maven2WEB
github.com/CVEProject/cvelistV5/tree/main/cves/2025/12xxx/CVE-2025-12183.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-12183Advisory

Show all 13 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities