Critical Security Update for JDK Mission Control: Addressing Information Disclosure in lz4-java
Summary
ALSA-2026:0752: Important: jmc security update. Affects jmc versions < 8.2.0-18.el9_7.2. Fixed in 8.2.0-18.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JDK Mission Control (JMC) is a sophisticated profiling tool designed for HotSpot JVMs, offering a comprehensive suite of tools for analyzing extensive data collected by JDK Flight Recorder. It enables developers and system administrators to gather and scrutinize performance data from Java applications, whether they are running locally or in production environments. This powerful tool is essential for optimizing application performance and ensuring efficient resource management. However, it has been found vulnerable to a security issue that could lead to information disclosure.
Vulnerability Detail
The vulnerability identified as CVE-2025-66566 pertains to the lz4-java library used within JDK Mission Control. It arises from insufficient output buffer clearing, which could potentially allow unauthorized access to sensitive information. This flaw could be exploited by malicious actors to extract confidential data from the application’s memory, leading to severe security breaches. The implications of this vulnerability are significant, as it compromises the integrity and confidentiality of the data processed by Java applications.
How To Fix
Minimum fixed version
8.2.0-18.el9_7.2
This is the first release that contains the fix.
sudo dnf update jmcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users are advised to limit access to the application and monitor for any suspicious activity until the package can be updated. Additionally, ensuring that sensitive data is not stored in memory unnecessarily can help mitigate the risk of information disclosure.
Conclusion
In summary, the vulnerability CVE-2025-66566 in the lz4-java library poses a significant risk of information disclosure within JDK Mission Control. It is essential for users to update to the latest patched version to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring the security of your applications.
See every vulnerability recorded for jmc →
FAQ
CVE-2025-66566 is a security vulnerability in the lz4-java library used by JDK Mission Control, which can lead to information disclosure due to insufficient output buffer clearing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary risk is unauthorized access to sensitive information, which can lead to data breaches and compromise the security of the application.
Yes, a patch is available. Users should update to version 8.2.0-18.el9_7.2 or later of the JDK Mission Control package.
If immediate updating is not possible, limit access to the application and monitor for any unusual activity as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for jmc.
