Insufficient Buffer Clearing in LZ4 Java Compression Library from yawkat
CVE-2025-66566

8.2HIGH

Key Information:

Vendor

Yawkat

Status
Lz4-java
Vendor
CVE Published:
5 December 2025

What is CVE-2025-66566?

The LZ4 Java compression library, developed by yawkat, has a vulnerability that stems from insufficient clearing of the output buffer in its Java-based decompressor implementations. This flaw, present in versions 1.10.0 and earlier, permits remote attackers to exploit crafted compressed input to read residual data from previous operations. In scenarios where the output buffer is reused without being properly cleared, this vulnerability could potentially lead to the unauthorized disclosure of sensitive information. Users are advised to upgrade to version 1.10.1, where this issue has been resolved.

Affected Version(s)

lz4-java < 1.10.1

References

https://github.com/yawkat/lz4-java/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/yawkat/lz4-java/commit/33d180cb70c4d93...
x_refsource_MISC

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-66566 : Insufficient Buffer Clearing in LZ4 Java Compression Library from yawkat