Red Hat JBoss Enterprise Application Platform 8.1.4 addresses two security vulnerabilities in the lz4-java compression library used within the platform. CVE-2025-12183 involves out-of-bounds memory operations that can cause denial of service and information disclosure. CVE-2025-66566 concerns information disclosure resulting from insufficient clearing of output buffers. These issues are fixed by upgrading lz4-java to version 1.10.1.rhel8-redhat-00001 as part of the 8.1.4 update. The advisory recommends applying this update after ensuring all prior errata are applied and backing up existing installations.

The vulnerabilities can lead to denial of service conditions and unauthorized information disclosure within applications running on Red Hat JBoss Enterprise Application Platform 8.1. Prior to the update, exploitation of these flaws could compromise confidentiality and availability of affected systems. Red Hat rates the security impact as Important, indicating a high severity but not critical. There are no known exploits in the wild at this time.

Red Hat has released an official security update in JBoss Enterprise Application Platform 8.1.4 that addresses these vulnerabilities by upgrading the lz4-java library. Users should apply this update promptly after verifying all previous errata are installed and backing up their systems. Detailed update instructions are available in the Red Hat advisory and related documentation. No additional mitigation steps are indicated by the vendor.