Critical Security Flaw in JDK Mission Control: Information Disclosure in lz4-java
Summary
RLSA-2026:0752: Important: jmc security update. Affects jmc versions < 0:8.2.0-18.el9_7.2. Fixed in 0:8.2.0-18.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JDK Mission Control (JMC) is a sophisticated profiling tool designed for HotSpot JVMs, allowing developers and administrators to efficiently collect and analyze data from Java applications. It provides an advanced set of tools for detailed analysis of data gathered by JDK Flight Recorder, making it essential for performance tuning and troubleshooting in both local and production environments. However, a recent vulnerability has been identified in the lz4-java library, which is utilized by JMC, potentially exposing sensitive information.
Vulnerability Detail
The vulnerability, identified as CVE-2025-66566, arises from insufficient output buffer clearing in the lz4-java library. This flaw can lead to information disclosure, where sensitive data may be inadvertently exposed to unauthorized users. The implications of this vulnerability are significant, as it could allow attackers to access confidential information that should remain protected, thereby compromising the integrity and confidentiality of the affected applications.
How To Fix
Minimum fixed version
0:8.2.0-18.el9_7.2
This is the first release that contains the fix.
sudo dnf update jmcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users should limit access to the affected applications and ensure that sensitive data is not processed until the package is updated. Additionally, monitoring for any unusual access patterns may help mitigate the risk until a full update can be applied.
Conclusion
The identified vulnerability in JDK Mission Control poses a significant risk due to potential information disclosure. It is crucial for users to update their software to the latest patched version to protect against this security flaw. By following the outlined steps and utilizing available tools like Vulert, users can effectively manage and mitigate risks associated with open-source vulnerabilities.
See every vulnerability recorded for jmc →
FAQ
CVE-2025-66566 is a security vulnerability in the lz4-java library used by JDK Mission Control, which can lead to information disclosure due to insufficient output buffer clearing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to unauthorized access to sensitive information, potentially compromising the confidentiality and integrity of the affected applications.
Yes, a patch is available. Users should update to JDK Mission Control version 0:8.2.0-18.el9_7.2 or later to fix the vulnerability.
If immediate updating is not possible, limit access to the affected applications and monitor for any unusual activity until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for jmc.
