Information disclosure in lz4-java - CVE-2025-66566

Vulnerability identifier: #VU121007

CSH Severity: Medium

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-66566

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the application insufficiently clears the output buffer in Java-based decompressor implementations. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data.

Note, JNI-based implementations are not affected.

lz4-java
clickhouse-java
Enterprise Build of Quarkus
Log Analysis
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Cloud Application Performance Management (APM)
IBM Maximo Application Suite - Manage Component
Logstash
Infrastructure Technology
Red Hat build of Quarkus
IBM Global High Availability Mailbox
App Connect Enterprise Certified Container
Elasticsearch
Oracle Banking Corporate Lending Process Management
Oracle Banking Origination
Oracle Banking Branch
Oracle Banking Cash Management
Stream Analytics
IBM Qradar SIEM
Communications Service Catalog and Design
IBM InfoSphere Information Server
Oracle Communications BRM - Elastic Charging Engine
Oracle Essbase
IBM Disconnected Log Collector
Red Hat Camel for Spring Boot
jmc (Red Hat package)

Install updates from vendor's website.

lz4-java - update to 1.10.1
clickhouse-java - update to 0.9.6
Log Analysis - update to 1.3.8.3 IF001
Enterprise Build of Quarkus - update to 3.27.1.SP1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
Elasticsearch - addressed in versions 8.19.10, 9.1.10, 9.2.4
IBM Qradar SIEM - update to 7.5.0 Update Pack 15 IF05
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.19
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.34, 8.7.28, 9.0.21, 9.1.8
Logstash - addressed in versions 8.19.10, 9.1.10, 9.2.4
IBM InfoSphere Information Server - update to 11.7.1.6 Service pack 1
IBM Disconnected Log Collector - update to 2.0.1
Red Hat build of Quarkus - addressed in versions 3.20.4.SP1, 3.27.1.SP1
Red Hat Camel for Spring Boot - addressed in versions 4.10, 4.14, 4.14.2
IBM Global High Availability Mailbox - addressed in versions 6.2.0.6 6212, 6.2.0.6 6221
jmc (Red Hat package) - addressed in versions 8.2.0-18.el9_6.2, 8.2.0-18.el9_7.2, 8.2.0-19.el9_8.2
App Connect Enterprise Certified Container - addressed in versions 12.0.23, 13.1.0

• https://github.com/yawkat/lz4-java/commit/33d180cb70c4d93c80fb0dc3ab3002f457e93840
• https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q

• Information disclosure in lz4-java
• Multiple vulnerabilities in Red Hat build of Quarkus 3.20.4
• Multiple vulnerabilities in Red Hat build of Quarkus 3.27.1
• Multiple vulnerabilities in IBM Enterprise Build of Quarkus
• Information disclosure in Red Hat Camel for Spring Boot 4
• Information disclosure in Red Hat Camel for Spring Boot 4
• clickhouse-java update for third-party components
• Elasticsearch update for LZ4 Java library
• Information disclosure in Red Hat Camel for Spring Boot 4.14
• Red Hat Enterprise Linux 9 update for jmc
• Red Hat Enterprise Linux 9 update for jmc
• Information disclosure in Oracle Essbase
• IBM Maximo Application Suite - Manage Component update for yawkat
• Multiple vulnerabilities in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Log Analysis
• Logstash update for lz4-java
• Multiple vulnerabilities in IBM Watson Discovery Cartridge
• Information disclosure in Stream Analytics
• Multiple vulnerabilities in Oracle Banking Branch
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Communications Service Catalog and Design
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Infrastructure Technology
• Multiple vulnerabilities in IBM Application Performance Management
• Multiple vulnerabilities in IBM App Connect Enterprise Certified Containers Operands
• Red Hat Enterprise Linux 9 update for jmc
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in IBM Global High Availability Mailbox