This advisory addresses two security vulnerabilities in the lz4-java component used by Red Hat JBoss Enterprise Application Platform 8. The first vulnerability (CVE-2025-12183) involves out-of-bounds memory operations that can cause denial of service and information disclosure. The second vulnerability (CVE-2025-66566) concerns information disclosure through insufficient clearing of output buffers. Red Hat has released version 8.1.4 of JBoss EAP 8.1 for RHEL 8 to remediate these issues by upgrading the lz4-java library to version 1.10.1.rhel8-redhat-00001. The advisory recommends applying this update after ensuring all prior errata are applied and backing up existing installations.

Successful exploitation of CVE-2025-12183 can lead to denial of service and unauthorized information disclosure due to out-of-bounds memory operations in the lz4-java library. CVE-2025-66566 allows information disclosure through insufficient clearing of output buffers. These vulnerabilities affect the confidentiality and availability of applications running on the affected platform.

A security update is available in Red Hat JBoss Enterprise Application Platform 8.1.4 for RHEL 8 that addresses these vulnerabilities by upgrading the lz4-java library. Users should apply this update after ensuring all previously released errata are installed and backing up their systems. Detailed update instructions are available from Red Hat's official documentation. No additional mitigations are specified beyond applying the official update.