Package · Maven

org.lz4:lz4-pure-java

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

High 8.2

CVE-2025-66566

yawkat LZ4 Java has a possible information leak in Java safe decompressor

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In a…

yawkat lz4-java zipkin spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven

Dec 5, 2025
High 8.8

CVE-2025-12183

org.lz4:lz4-java - Out-of-Bounds Memory Access

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

zipkin spark-4.0-scala-2.13 spark-4.1-scala-2.13 strimzi-kafka-operator-kafka-thirdparty-libs-cc Debian Ubuntu Wolfi Maven

Nov 28, 2025