CVE-2025-12183: Lz4-java Out-of-Bounds Read Vulnerability

Key Information Vulnerability Overview CVE ID: CVE-2025-12183 Summary: Multiple LZ4-java compression and decompression implementations lack protection against out-of-bounds memory access. Untrusted input may lead to denial of service and information disclosure. Affected Maven Coordinates org.lz4:lz4-java <=1.8.0 org.lz4:lz4-pure-java <=1.8.0 net.jpountz.lzron:lz4 <=1.8.0 Severity and Weakness Enumeration Rating: High - 8.8 CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N CWE: CWE-125: Out-of-bounds Read Technical Description lz4-java provides a set of compression and decompression algorithms: - JNI implementation based on the lz4 library (LZ4Factory.nativeInstance(), LZ4Factory.fastestInstance()) - Java implementation using deprecated sun.misc.Unsafe API (LZ4Factory.unsafeInstance(), LZ4Factory.fastestInstance(), LZ4Factory.fastestJavaInstance()) - Java implementation without using sun.misc.Unsafe (LZ4Factory.safeInstance()) Workarounds Applications using LZ4Factory.nativeInstance().fastDecompressor() can switch to .safeInstance() Applications using LZ4Factory.unsafeInstance(), .fastestInstance(), .fastestJavaInstance() can switch to .safeInstance() Patches Due to the unavailability of the official maintainer, the lz4 organization has decided to discontinue maintenance of this project. Community-maintained fork: https://github.com/yawkat/lz4-java Acknowledgments Jonas Konrad (Oracle corp.): Discovery and patch Marcono1234: Patch and review Sonatype: Disclosure coordination; pom relocation

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-12183: Lz4-java Out-of-Bounds Read Vulnerability