Red Hat JBoss Enterprise Application Platform 8.1.4 replaces version 8.1.3 and includes security fixes for two lz4-java vulnerabilities: CVE-2025-12183, which allows out-of-bounds memory operations causing denial of service and information disclosure, and CVE-2025-66566, which allows information disclosure via insufficient output buffer clearing. These vulnerabilities relate to memory safety and data handling in the lz4-java compression library used within the platform. The update is provided as an official security advisory (RHSA-2026:1870) by Red Hat Product Security and is rated with an Important security impact. No CVSS scores are provided in the advisory. The update also includes other bug fixes and enhancements.

The vulnerabilities can lead to denial of service and information disclosure within applications running on Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8. Specifically, out-of-bounds memory operations may cause application crashes or expose sensitive data, while insufficient buffer clearing can leak information. These impacts can affect the confidentiality and availability of affected systems. There are no known exploits in the wild at the time of the advisory.

An official security update to Red Hat JBoss Enterprise Application Platform 8.1.4 is available that addresses these vulnerabilities by upgrading the lz4-java library to a fixed version. Red Hat recommends applying this update after ensuring all previously released errata are applied and backing up all relevant data and configurations. Detailed update instructions are available from Red Hat's documentation. No alternative mitigations or workarounds are indicated in the advisory.