Cloudanix VulnDB

CVE-2025-66566

None

CVSS

—

EPSS

0.6%

Published

Dec 5, 2025

CISA due date

—

The record

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.

Affected packages

Ecosystem Package Introduced Fixed
Maven at.yawk.lz4:lz4-java 0 1.10.1
Maven net.jpountz.lz4:lz4 0 No fix
Maven org.lz4:lz4-java 0 No fix
Maven org.lz4:lz4-pure-java 0 No fix
AlmaLinux:9 jmc 0 8.2.0-18.el9_7.2
Chainguard apache-hop 0 2.17.0-r5
Chainguard apache-hop-fips 0 2.17.0-r5
Chainguard cassandra-4.0 0 4.0.20-r0
Chainguard cassandra-4.1 0 4.1.11-r0
Chainguard cassandra-fips-4.0 0 4.0.19-r5
Chainguard cassandra-fips-4.1 0 4.1.10-r5
Chainguard debezium-connector-ibmi-3.5 0 3.5.0-r1
Chainguard debezium-connector-informix-3.5 0 3.5.0-r1
Chainguard debezium-connector-spanner-3.4 0 3.4.2-r1
Chainguard kafka-3.7 0 3.7.2-r53
Chainguard kafka-3.8 0 3.8.1-r52
Chainguard kafka-4.0 0 4.0.1-r8
Chainguard kafka-4.1 0 4.1.1-r7
Chainguard kafka-fips-4.1 0 4.1.1-r3
Chainguard logstash-8.17 0 8.17.10-r18
Chainguard logstash-8.17-iamguarded-compat 0 8.17.10-r18
Chainguard logstash-8.17-with-output-opensearch 0 8.17.10-r18
Chainguard logstash-9.0 0 9.0.8-r17
Chainguard logstash-9.0-iamguarded-compat 0 9.0.8-r17
Chainguard logstash-9.0-with-output-opensearch 0 9.0.8-r17
Chainguard opensearch-2-security 0 2.19.4-r12
Chainguard sonarqube 0 26.2.0.119303-r2
Chainguard spark-3.5-scala-2.12 0 3.5.8-r9
Chainguard spark-3.5-scala-2.13 0 3.5.8-r9
Chainguard spark-4.0-scala-2.13 0 4.0.2-r8
Chainguard spark-4.1-scala-2.13 0 4.1.1-r9
Chainguard spark-fips-3.5-scala-2.12 0 3.5.4-r28
Chainguard spark-fips-3.5-scala-2.13 0 3.5.4-r28
Chainguard spark-fips-4.1-scala-2.13 0 4.1.1-r7
Chainguard strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.51.0-r2
Chainguard zipkin 0 3.5.1-r14
Chainguard zipkin-slim 0 3.5.1-r14
Wolfi cassandra-4.1 0 4.1.11-r0
Wolfi debezium-connector-ibmi-3.5 0 3.5.0-r1
Wolfi debezium-connector-informix-3.5 0 3.5.0-r1
Wolfi debezium-connector-spanner-3.4 0 3.4.2-r1
Wolfi kafka-3.8 0 3.8.1-r52
Wolfi kafka-4.0 0 4.0.1-r8
Wolfi kafka-4.1 0 4.1.1-r7
Wolfi opensearch-2-security 0 2.19.4-r12
Wolfi sonarqube 0 26.2.0.119303-r2
Wolfi spark-3.5-scala-2.12 0 3.5.8-r9
Wolfi spark-3.5-scala-2.13 0 3.5.8-r9
Wolfi spark-4.0-scala-2.13 0 4.0.2-r8
Wolfi spark-4.1-scala-2.13 0 4.1.1-r9
Wolfi strimzi-kafka-operator-kafka-thirdparty-libs-cc 0 0.51.0-r2
Wolfi zipkin 0 3.5.1-r14
Wolfi zipkin-slim 0 3.5.1-r14

Related vulnerabilities