Red Hat JBoss Enterprise Application Platform 8.1.4 addresses two security vulnerabilities in the lz4-java compression library: CVE-2025-12183, which involves out-of-bounds memory operations potentially causing denial of service and information disclosure, and CVE-2025-66566, which involves information disclosure due to insufficient clearing of output buffers. These vulnerabilities affect the compression component used within the platform. The update to version 8.1.4 replaces 8.1.3 and includes these security fixes along with other bug fixes and enhancements. Red Hat has issued an advisory (RHSA-2026:1871) detailing these fixes and recommends applying the update for affected systems running JBoss EAP 8.1 on RHEL 9.

The vulnerabilities in the lz4-java library could allow attackers to cause denial of service conditions and disclose sensitive information due to improper memory handling and insufficient buffer clearing. This could affect the confidentiality and availability of applications running on Red Hat JBoss Enterprise Application Platform 8.1 prior to the 8.1.4 update. The security impact is rated as Important by Red Hat, indicating a high risk if unpatched.

Red Hat has released version 8.1.4 of JBoss Enterprise Application Platform 8.1 for RHEL 9 which includes fixes for these vulnerabilities by upgrading the lz4-java library to a secure version (1.10.1.rhel8-redhat-00001). Users should apply this official update after ensuring all previous errata are applied and backing up their systems. No alternative mitigations are specified; applying the official patch is the recommended remediation.