Threats Tagged 'cve-2025-66566'

JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced set of tools that enables efficient and detailed analysis of the extensive data collected by JDK Flight Recorder. The tool chain enables developers and administrators to collect and analyze data from Java applications running locally or deployed in production environments. Security Fix(es): * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566) * org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.4 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.3, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.4 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * lz4-java: lz4-java: Out-of-bounds memory operations lead to denial of service and information disclosure (CVE-2025-12183) * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.4 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.3, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.4 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * lz4-java: lz4-java: Out-of-bounds memory operations lead to denial of service and information disclosure (CVE-2025-12183) * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat JBoss Enterprise Application Platform 8 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 8.1.4 serves as a replacement for Red Hat JBoss Enterprise Application Platform 8.1.3, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 8.1.4 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * lz4-java: lz4-java: Out-of-bounds memory operations lead to denial of service and information disclosure (CVE-2025-12183) * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update is now available for the Red Hat build of Cryostat 4 on RHEL 9. Security Fix(es): * lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566) * qs: Denial of Service via improper input validation in array parsing (CVE-2025-15284) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

An update for Red Hat Build of Apache Camel 4.10 for Quarkus 3.20 update is now available (RHBQ 3.20.4.SP1). The purpose of this text-only errata is to inform you about the enhancements that improve your developer experience and ensure the security and stability of your products: * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing (CVE-2025-66566)

This release of Red Hat build of Quarkus 3.27.1.SP1 includes the following CVE fixes: * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing [quarkus-3.27] (CVE-2025-66566) * lz4-java: lz4-java: Out-of-bounds memory operations lead to denial of service and information disclosure [quarkus-3.27] (CVE-2025-12183) * vertx-web: Eclipse Vert.x cross site scripting [quarkus-3.27] (CVE-2025-11966) For more information, see the release notes page listed in the References section.

This release of Red Hat build of Quarkus 3.20.4.SP1 includes the following CVE fixes: * lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing [quarkus-3.20] (CVE-2025-66566) * lz4-java: lz4-java: Out-of-bounds memory operations lead to denial of service and information disclosure [quarkus-3.20] (CVE-2025-12183) * vertx-web: Eclipse Vert.x cross site scripting [quarkus-3.20 (CVE-2025-11966) For more information, see the release notes page listed in the References section.

CVE-2025-66566 is a high-severity vulnerability in yawkat lz4-java versions prior to 1.10.1, where insufficient clearing of the output buffer in Java-based decompressor implementations allows remote attackers to read residual data from previous decompression operations. This can lead to disclosure of sensitive information if the output buffer is reused without proper clearing. The vulnerability does not affect JNI-based implementations and requires no authentication or user interaction to exploit. Although no known exploits are currently reported in the wild, the vulnerability poses a significant confidentiality risk. The issue is fixed in version 1.10.1 of lz4-java. European organizations using vulnerable versions in their Java applications, especially those handling sensitive data, should prioritize upgrading to mitigate potential data leakage.

HighVulnerabilityGermanyFranceNetherlands+5#cve#cve-2025-66566#cwe-201

Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed backbone that allows microservices and other applications to share data with extremely high throughput and extremely low latency. This release of Red Hat Streams for Apache Kafka 2.9.3 serves as a replacement for Red Hat Streams for Apache Kafka 2.9.2, and includes security and bug fixes, and enhancements. * Cruise Control Netty MadeYouReset org.eclipse.jetty:jetty-http: jetty: Jetty URI parsing of invalid authority [amq-st-2.9] "(CVE-2025-58057)"