CVE-2025-66566

Publication date 5 December 2025

Last updated 4 February 2026

Ubuntu priority

Description

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data. JNI-based implementations are not affected. This vulnerability is fixed in 1.10.1.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
lz4-java	25.10 questing	Vulnerable
	25.04 plucky	Ignored end of life, was needs-triage
	24.04 LTS noble	Vulnerable
	22.04 LTS jammy	Vulnerable
	20.04 LTS focal	Vulnerable

How can I get the fixes?
What do statuses mean?
Patch details

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
lz4-java	Upstream: 33d180c

References

MITRE
NVD
Launchpad
Debian

Other references

https://www.cve.org/CVERecord?id=CVE-2025-66566
https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q
https://github.com/yawkat/lz4-java/commit/33d180cb70c4d93c80fb0dc3ab3002f457e93840