CVE-2025-12183: Out-of-bounds Memory Operations in LZ4 Java Compression Leading to DoS
Summary
CVE-2025-12183: LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS. Affects at.yawk.lz4:lz4-java versions < 1.8.1. Fixed in 1.8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LZ4 is a fast compression algorithm that is widely used in various applications for its high performance and low latency. The Java implementation of LZ4, known as lz4-java, is utilized in many Java applications for efficient data compression. However, versions 1.8.0 and earlier of this package are vulnerable to out-of-bounds memory operations, which can be exploited by attackers to cause denial of service (DoS) and potentially read adjacent memory.
Vulnerability Detail
The vulnerability arises from improper handling of untrusted compressed input in the lz4-java library. Attackers can craft specific input that triggers out-of-bounds memory access, leading to application crashes or unexpected behavior. This vulnerability is classified under CWE-125, indicating a risk of accessing memory outside the allocated bounds, which can compromise application stability and security.
How To Fix
Minimum fixed version
1.8.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update to the patched version, consider validating and sanitizing all compressed input before processing it to mitigate the risk of exploitation. Implementing strict checks on input size and format can help prevent out-of-bounds access.
Conclusion
The CVE-2025-12183 vulnerability in the lz4-java library poses a significant risk due to out-of-bounds memory operations that can lead to denial of service. It is crucial for developers using this library to update to version 1.8.1 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for at.yawk.lz4:lz4-java →
FAQ
CVE-2025-12183 is a vulnerability in the lz4-java library that allows attackers to exploit out-of-bounds memory operations, potentially leading to denial of service.
Versions 1.8.0 and earlier of the lz4-java library are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply checking your pom.xml file on the Vulert playground, you can determine if your application is affected by this vulnerability.
If an immediate update is not possible, implement input validation and sanitization to reduce the risk of exploitation until you can upgrade to the patched version.
More information can be found in the advisory database and on the GitHub repository for lz4-java, which has details on the vulnerability and its impact.
Related vulnerabilities
Recent vulnerabilities recorded for at.yawk.lz4:lz4-java.
