Threat Intelligence Database

A memory allocation vulnerability exists in yawkat lz4-java prior to version 1.11.2. The LZ4DecompressorWithLength component trusts a decompressed-length header from input data without validating it, allowing an attacker to specify a large output size. This can cause the JVM heap to be exhausted by allocating up to approximately 2 GiB of memory. Overloads that write to a caller-provided buffer are not affected. The issue is fixed in version 1.11.2.

A vulnerability in yawkat lz4-java prior to version 1.11.2 allows an attacker to cause excessive memory allocation by providing a crafted LZ4 block header. This can lead to near-2 GiB heap exhaustion in the JVM, resulting in denial of service. The issue arises because the compressedLen field is validated only for non-negativity but not for size limits before allocating memory. This flaw is fixed in version 1.11.2.

A time-of-check to time-of-use (TOCTOU) race condition exists in yawkat lz4-java versions prior to 1.11.4. The vulnerability arises from the way temporary files are created and used during native library loading, allowing a local attacker with access to the shared temporary directory to replace the library file before it is loaded. This can lead to execution of arbitrary native code. Systems with hardened protections or alternative configurations may fail to load the malicious library and fall back to Java implementations. The issue is fixed in version 1.11.4.

yawkat lz4-java versions prior to 1.11.4 have a resource allocation vulnerability in the LZ4FrameInputStream readHeader() method. When processing maximum-block-size frame headers in concatenated-frame mode, the code allocates two 4 MiB buffers per frame, allowing attacker-controlled streams with many minimal empty frames to cause excessive memory allocation and CPU consumption without producing decompressed output. This can lead to denial of service due to resource exhaustion. The issue does not affect readSingleFrame mode and is fixed in version 1.11.4.

yawkat lz4-java versions prior to 1.11.4 have a vulnerability where the LZ4BlockInputStream class, when configured with stopOnEmptyBlock set to false, can recursively call refill() on empty LZ4 blocks. This can lead to stack exhaustion and a StackOverflowError. The default configuration (stopOnEmptyBlock true) is not affected. The issue does not cause memory corruption and is fixed in version 1.11.4.

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.

CVE-2025-66566 is a high-severity vulnerability in yawkat lz4-java versions prior to 1.10.1, where insufficient clearing of the output buffer in Java-based decompressor implementations allows remote attackers to read residual data from previous decompression operations. This can lead to disclosure of sensitive information if the output buffer is reused without proper clearing. The vulnerability does not affect JNI-based implementations and requires no authentication or user interaction to exploit. Although no known exploits are currently reported in the wild, the vulnerability poses a significant confidentiality risk. The issue is fixed in version 1.10.1 of lz4-java. European organizations using vulnerable versions in their Java applications, especially those handling sensitive data, should prioritize upgrading to mitigate potential data leakage.

HighVulnerabilityGermanyFranceNetherlands+5#cve#cve-2025-66566#cwe-201

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

HighVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-12183#cwe-125