CVE-2025-66566: yawkat LZ4 Java Information Leak in Safe Decompressor
Summary
CVE-2025-66566: yawkat LZ4 Java has a possible information leak in Java safe decompressor. Affects at.yawk.lz4:lz4-java versions < 1.10.1. Fixed in 1.10.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The LZ4 Java library, specifically versions 1.10.0 and earlier, is designed for high-performance compression and decompression of data. It is widely used in applications requiring efficient data handling. However, a vulnerability has been identified that allows attackers to exploit insufficient clearing of the output buffer during decompression, potentially leading to sensitive data leakage.
Vulnerability Detail
The vulnerability arises from the Java-based decompressor implementations in lz4-java, where the output buffer is not adequately cleared before reuse. This oversight allows remote attackers to read previous contents of the buffer through specially crafted compressed input. If the output buffer retains sensitive information from previous operations, it can be inadvertently exposed in the decompressed output. This issue is particularly severe when the output buffer is reused without proper initialization.
How To Fix
Minimum fixed version
1.10.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not feasible, a temporary workaround involves zeroing the output buffer before passing it to the decompression function. This can be done in Java as follows:
byte[] outputBuffer = new byte[bufferSize];
Arrays.fill(outputBuffer, (byte) 0);
// Now use outputBuffer for decompression
Conclusion
The vulnerability CVE-2025-66566 in the yawkat LZ4 Java library poses a significant risk of information leakage due to improper handling of the output buffer during decompression. Users are strongly advised to upgrade to version 1.10.1 or implement the recommended workaround to mitigate potential risks.
See every vulnerability recorded for at.yawk.lz4:lz4-java →
FAQ
CVE-2025-66566 is a vulnerability in the yawkat LZ4 Java library that allows for potential information leakage due to insufficient clearing of the output buffer.
Versions 1.10.0 and earlier of lz4-java are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
If upgrading to version 1.10.1 is not possible, you can mitigate the issue by zeroing the output buffer before use.
No, JNI-based implementations are not affected by this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for at.yawk.lz4:lz4-java.
