This advisory covers two security vulnerabilities in the Red Hat build of Cryostat 4 on RHEL 9. The first vulnerability (CVE-2025-66566) involves information disclosure via insufficient clearing of output buffers in the lz4-java component. The second vulnerability (CVE-2025-15284) is a denial of service caused by improper input validation during array parsing in the qs component. Red Hat has released an update to address these issues, rated as important in severity. The advisory references the Red Hat Security Advisory RHSA-2026:0761 for detailed remediation instructions.

The information disclosure vulnerability could potentially expose sensitive data due to insufficient buffer clearing. The denial of service vulnerability could allow an attacker to disrupt service availability by exploiting improper input validation. Both vulnerabilities are rated as important by Red Hat, indicating a high security impact but no known active exploitation in the wild at this time.

Red Hat has released an official security update for Cryostat 4 on RHEL 9 that addresses these vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available in the Red Hat advisory RHSA-2026:0761 and the referenced knowledge base article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor.