Search: CVE-2025-66566

CVE-2025-66566 is a high-severity vulnerability in yawkat lz4-java versions prior to 1.10.1, where insufficient clearing of the output buffer in Java-based decompressor implementations allows remote attackers to read residual data from previous decompression operations. This can lead to disclosure of sensitive information if the output buffer is reused without proper clearing. The vulnerability does not affect JNI-based implementations and requires no authentication or user interaction to exploit. Although no known exploits are currently reported in the wild, the vulnerability poses a significant confidentiality risk. The issue is fixed in version 1.10.1 of lz4-java. European organizations using vulnerable versions in their Java applications, especially those handling sensitive data, should prioritize upgrading to mitigate potential data leakage.