This advisory addresses two security vulnerabilities in the lz4-java component used by Red Hat JBoss Enterprise Application Platform 8.1. The first vulnerability (CVE-2025-12183) is an out-of-bounds memory operation that can cause denial of service and information disclosure. The second vulnerability (CVE-2025-66566) involves information disclosure resulting from insufficient clearing of output buffers. Red Hat has released version 8.1.4 of JBoss Enterprise Application Platform, which includes upgrades to lz4-java (to version 1.10.1.rhel8-redhat-00001) that fix these issues. The update also includes other component upgrades and bug fixes. No CVSS score is provided in the advisory, but the vendor classifies the impact as Important.

The vulnerabilities can lead to denial of service and information disclosure in affected Red Hat JBoss Enterprise Application Platform 8.1 deployments. Specifically, out-of-bounds memory operations may be exploited to disrupt service or leak sensitive information. Insufficient output buffer clearing may also expose information unintentionally. There are no known exploits in the wild at this time. The vendor rates the security impact as Important, indicating a significant but not critical risk.

Red Hat has released an official security update in Red Hat JBoss Enterprise Application Platform 8.1.4 that addresses these vulnerabilities by upgrading the lz4-java library. Users should apply this update after ensuring all prior relevant errata are installed and backing up their systems. Detailed update instructions are available from Red Hat. No additional mitigations are indicated or required beyond applying the official fix.