CVE-2025-66566: yawkat lz4-java

CVSS: 8.2v4.0HighDeferred

AliasesRHSA-2026:0751RHSA-2026:0752RHSA-2026:1823+231 more

Published 05-12-2025Last modified 05-12-2025

Vulnerability summary

CVE-2025-66566 is a high (CVSS 8.2) vulnerability in yawkat lz4-java. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.8% of scored vulnerabilities.

Overall risk

33/100

0100

Medium · default modelHow is this calculated?

CVSS score

8.2/10

010

High · v4.0 (CVE.org)

EPSS score

0.60%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 3 · Related 1

RHSA-2026:1870 RHSA-2026:1871 RHSA-2026:20568 CGA-3HMX-6MPF-9XPH

Timeline

05-12-2025
PublishedVulnerability first disclosed.
05-12-2025
Last modifiedVulnerability information updated.

Description

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.

CVSS metrics

8 scores · 8 sources · 2 versions

v4.08.2v3.17.5

EPSS trend

Probability

0.60%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

0.00 pp

From 0.60% on 18-09-2026

18-09-202618-10-2026

EPSS score

0.60%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-201Insertion of Sensitive Information Into Sent DataThe code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Affected systems

Chainguard102 products

apache-hop< 2.17.0-r4 | < 2.17.0-r5
apache-hop-fips< 2.17.0-r4 | < 2.17.0-r5
cassandra-4.0< 4.0.20-r0
cassandra-4.1< 4.1.11-r0
cassandra-fips-4.0< 4.0.19-r5 | < 4.0.19-r4

cassandra-fips-4.1< 4.1.10-r4 | < 4.1.10-r5
cassandra-fips-5.0< 5.0.6-r6 | < 5.0.6-r5
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-8.18All versions (No fix recorded)
commercial-elasticsearch-9.0All versions (No fix recorded)
debezium-3.5-connector-jdbc< 3.5.1-r0
debezium-3.5-connector-mariadb< 3.5.1-r0
debezium-3.5-connector-mongodb< 3.5.1-r0
debezium-3.5-connector-mysql< 3.5.1-r0
debezium-3.5-connector-postgres< 3.5.1-r0
debezium-3.5-connector-sqlserver< 3.5.1-r0
debezium-connector-db2-3.5< 3.5.0-r1
debezium-connector-ibmi-3.5< 3.5.0-r1
debezium-connector-informix-3.5< 3.5.0-r1
debezium-connector-spanner-3.4< 3.4.2-r1
debezium-connector-spanner-3.5< 3.5.1-r1
debezium-connector-vitess-3.5< 3.5.1-r1
elasticsearch-7All versions (No fix recorded)
elasticsearch-7-iamguardedAll versions (No fix recorded)
elasticsearch-8.17All versions (No fix recorded)
elasticsearch-8.18All versions (No fix recorded)
elasticsearch-8.18-iamguardedAll versions (No fix recorded)
elasticsearch-9.0All versions (No fix recorded)
elasticsearch-9.0-iamguardedAll versions (No fix recorded)
elasticsearch-fips-8.17All versions (No fix recorded)
elasticsearch-fips-8.17-bitnamiAll versions (No fix recorded)
elasticsearch-fips-8.18All versions (No fix recorded)
elasticsearch-fips-8.18-bitnamiAll versions (No fix recorded)
elasticsearch-fips-9.0All versions (No fix recorded)
elasticsearch-fips-9.0-bitnamiAll versions (No fix recorded)
hadoop-fips-3.3.6< 3.3.6-r26
hadoop-fips-3.4.2All versions (No fix recorded)
kafbat-ui< 1.5.0-r0
kafbat-ui-fips< 1.5.0-r0
kafka_exporter-strimzi-compat< 1.2.0-r5
kafka-3.7< 3.7.2-r53
kafka-3.8< 3.8.1-r52
kafka-4.0< 4.0.1-r8
kafka-4.1< 4.1.1-r7
kafka-fips-4.1< 4.1.1-r3
kafka-strimzi-compat< 1.2.0-r5
knative-kafka-broker-1.17-dispatcher-loom< 1.17.3-r6 | < 1.17.3-r14
knative-kafka-broker-1.17-receiver-loom< 1.17.3-r14 | < 1.17.3-r6
knative-kafka-broker-1.18-dispatcher-loom< 1.18.2-r8 | < 1.18.2-r1
knative-kafka-broker-1.18-receiver-loom< 1.18.2-r8 | < 1.18.2-r1
knative-kafka-broker-1.20-dispatcher-loom< 1.20.2-r2 | < 1.20.3-r0
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r0 | < 1.20.2-r2
knative-kafka-broker-1.21-dispatcher-loom< 1.21.1-r1 | < 1.21.2-r0
knative-kafka-broker-1.21-receiver-loom< 1.21.1-r1 | < 1.21.2-r0
knative-kafka-broker-1.22-dispatcher-loom< 1.22.1-r1
knative-kafka-broker-1.22-receiver-loom< 1.22.1-r1
knative-kafka-broker-fips-1.17-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-fips-1.17-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-fips-1.18-dispatcher-loomAll versions (No fix recorded)
knative-kafka-broker-fips-1.18-receiver-loomAll versions (No fix recorded)
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r2
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r2
knative-kafka-broker-fips-1.21-dispatcher-loom< 1.21.2-r2
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.2-r2
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.1-r1
knative-kafka-broker-fips-1.22-receiver-loom< 1.22.1-r1
logstash-8.17< 8.17.10-r18
logstash-8.17-iamguarded-compat< 8.17.10-r18
logstash-8.17-with-output-opensearch< 8.17.10-r18
logstash-8.18All versions (No fix recorded)
logstash-8.18-iamguarded-compatAll versions (No fix recorded)
logstash-8.18-with-output-opensearchAll versions (No fix recorded)
logstash-8.19< 8.19.14-r3
logstash-8.19-iamguarded-compat< 8.19.14-r3
logstash-8.19-with-output-opensearch< 8.19.14-r3
logstash-9.0< 9.0.8-r17
logstash-9.0-iamguarded-compat< 9.0.8-r17
logstash-9.0-with-output-opensearch< 9.0.8-r17
opensearch-2-security< 2.19.4-r12
prometheus-jmx-exporter-strimzi-compat< 1.6.0-r0
rangerAll versions (No fix recorded)
sonarqube< 26.2.0.119303-r2
spark-3.5-scala-2.12< 3.5.8-r9
spark-3.5-scala-2.13< 3.5.8-r9
spark-4.0-scala-2.13< 4.0.2-r8
spark-4.1-scala-2.13< 4.1.1-r9
spark-fips-3.5-scala-2.12< 3.5.4-r28
spark-fips-3.5-scala-2.13< 3.5.4-r28
spark-fips-4.1-scala-2.13< 4.1.1-r7
strimzi-kafka-operator< 1.2.0-r5
strimzi-kafka-operator-cluster-operator< 1.2.0-r5
strimzi-kafka-operator-fips-kafka-thirdparty-libs-cc< 1.0.0-r0
strimzi-kafka-operator-kafka-agent< 1.2.0-r5
strimzi-kafka-operator-kafka-base< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-kafka-init< 1.2.0-r5
strimzi-kafka-operator-kafka-thirdparty-libs< 1.2.0-r5 | All versions (No fix recorded)
strimzi-kafka-operator-kafka-thirdparty-libs-cc< 1.2.0-r5 | < 0.51.0-r2
strimzi-kafka-operator-topic-operatorAll versions (No fix recorded) | < 1.2.0-r5
strimzi-kafka-operator-tracing-agent< 1.2.0-r5
strimzi-kafka-operator-user-operator< 1.2.0-r5
zipkin< 3.5.1-r14
zipkin-slim< 3.5.1-r14

Show all 102

Wolfi32 products

cassandra-4.1< 4.1.11-r0
debezium-3.5-connector-jdbc< 3.5.1-r0
debezium-3.5-connector-mariadb< 3.5.1-r0
debezium-3.5-connector-mongodb< 3.5.1-r0
debezium-3.5-connector-mysql< 3.5.1-r0

Show all 32

Org.lz42 products

lz4-java≤ 1.8.1
lz4-pure-java≤ 1.8.1

At.yawk.lz41 product

lz4-java< 1.10.1

Debian1 product

lz4-javaAll versions (No fix recorded) | < 1.11.2+ds1-1

Net.jpountz.lz41 product

lz4≤ 1.8.1

Redhat1 product

jmc< 0:8.2.0-18.el9_6.2 | < 0:8.2.0-18.el9_7.2 | < 0:8.2.0-17.el9_4.2

Ubuntu1 product

lz4-javaAll versions (No fix recorded)

Yawkat1 product

lz4-java< 1.10.1

9 vendors · 142 products

References

17 links

github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63qX Refsource CONFIRMARTICLEREPORTAdvisoryWEB
github.com/yawkat/lz4-java/commit/33d180cb70c4d93c80fb0dc3ab3002f457e93840X Refsource MISCARTICLEREPORTFIXWEB
access.redhat.com/errata/RHSA-2026:0751Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2419500REPORT
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0751.jsonAdvisory
access.redhat.com/security/cve/CVE-2025-66566REPORT
www.cve.org/CVERecord?id=CVE-2025-66566AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2025-66566Advisory
access.redhat.com/errata/RHSA-2026:0752Advisory

Show all 17 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities