Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.4 security update

This advisory covers security fixes in Red Hat JBoss Enterprise Application Platform 8.1.4 related to the lz4-java library. Two vulnerabilities are addressed: CVE-2025-12183, which involves out-of-bounds memory operations that may cause denial of service and information disclosure, and CVE-2025-66566, which involves information disclosure due to insufficient clearing of output buffers. The update replaces version 8.1.3 and upgrades lz4-java to version 1.10.1.rhel8-redhat-00001. The advisory does not provide CVSS scores but rates the impact as Important. The update also includes multiple component upgrades and bug fixes.

The vulnerabilities in the lz4-java library could allow an attacker to cause denial of service or disclose sensitive information through out-of-bounds memory operations and insufficient output buffer clearing. This impacts the confidentiality and availability of applications running on Red Hat JBoss Enterprise Application Platform 8.1 prior to the 8.1.4 update. No known exploits in the wild have been reported at the time of the advisory.

Red Hat has released version 8.1.4 of JBoss Enterprise Application Platform which includes fixes for these vulnerabilities by upgrading the lz4-java library. Users should apply this update after ensuring all prior errata are applied and backing up their systems. The vendor advisory provides detailed instructions for applying the update. No alternative mitigations are specified. Patch status is official-fix; the update resolves the security issues.