CVE-2025-66566: LZ4 Java Information Disclosure Flaw

CVE-2025-66566 Overview

CVE-2025-66566 is an information disclosure vulnerability in yawkat LZ4 Java, a library that provides LZ4 compression for Java applications. The vulnerability stems from insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java version 1.10.0 and earlier. This flaw allows remote attackers to read previous buffer contents via crafted compressed input, potentially leading to the disclosure of sensitive data in applications where the output buffer is reused without being cleared.

Critical Impact

Remote attackers can exploit this vulnerability to read sensitive data from previous buffer contents, potentially exposing confidential information processed by the application.

Affected Products

• yawkat lz4-java versions 1.10.0 and earlier (Java-based decompressor implementations)
• Applications using lz4-java that reuse output buffers without clearing them
• Note: JNI-based implementations are not affected by this vulnerability

Discovery Timeline

• December 5, 2025 - CVE-2025-66566 published to NVD
• December 8, 2025 - Last updated in NVD database

Technical Details for CVE-2025-66566

Vulnerability Analysis

This vulnerability is classified under CWE-201 (Insertion of Sensitive Information Into Sent Data). The core issue lies in how the Java-based decompressor implementations handle output buffers during the decompression process. When processing LZ4-compressed data, the decompressor fails to properly clear or initialize the output buffer before writing decompressed content.

In scenarios where applications reuse buffers for performance optimization—a common practice in high-throughput data processing systems—residual data from previous operations may remain in portions of the buffer that aren't overwritten by the current decompression operation. An attacker who can supply crafted compressed input may be able to cause the decompressor to return a buffer containing this stale data, effectively leaking information from previous operations.

The network-based attack vector means this vulnerability can be exploited remotely without requiring authentication or user interaction, though successful exploitation requires specific conditions in the target application's buffer handling patterns.

Root Cause

The root cause of CVE-2025-66566 is the failure to properly sanitize output buffers in the Java-based LZ4 decompressor implementations. When decompression occurs, the output buffer should either be fully overwritten or explicitly cleared before use. The vulnerable code path does not ensure complete buffer clearing, leaving remnants of previous data accessible when:

1. The output buffer is allocated once and reused across multiple decompression operations
2. The decompressed data does not fully occupy the entire buffer space
3. An attacker crafts input that results in partial buffer utilization

This represents a classic information leakage pattern where memory is not properly sanitized between operations.

Attack Vector

The attack vector for this vulnerability is network-based, requiring the attacker to supply maliciously crafted LZ4-compressed data to a vulnerable application. The attack mechanism involves:

1. Reconnaissance: The attacker identifies an application using lz4-java versions 1.10.0 or earlier with Java-based decompressors
2. Crafted Input: The attacker creates specially crafted compressed data designed to trigger partial buffer utilization during decompression
3. Data Extraction: When the application processes the malicious input and returns or processes the output buffer, residual data from previous operations may be accessible
4. Information Disclosure: Sensitive data previously processed through the same buffer (credentials, personal information, cryptographic material) may be exposed

The vulnerability specifically affects Java-based decompressor implementations. JNI-based implementations use different buffer handling mechanisms and are not susceptible to this attack.

Detection Methods for CVE-2025-66566

Indicators of Compromise

• Unusual or malformed LZ4-compressed data received from external sources
• Anomalous decompression operations where output size doesn't match expected patterns
• Detection of sensitive data appearing in unexpected locations within application output
• Log entries indicating decompression errors or unusual buffer utilization patterns

Detection Strategies

• Implement dependency scanning to identify lz4-java versions 1.10.0 and earlier in your codebase
• Monitor for applications using lz4-java with Java-based decompressor classes rather than JNI implementations
• Conduct code reviews to identify buffer reuse patterns in applications using lz4-java
• Deploy runtime application self-protection (RASP) to detect anomalous decompression behavior

Monitoring Recommendations

• Enable detailed logging for all compression/decompression operations in affected applications
• Monitor network traffic for potentially malicious LZ4-compressed payloads
• Implement alerts for unusual data patterns in decompression output
• Track dependency versions across your software inventory to quickly identify vulnerable deployments

How to Mitigate CVE-2025-66566

Immediate Actions Required

• Upgrade lz4-java to version 1.10.1 or later immediately
• Audit applications using lz4-java to identify buffer reuse patterns
• Consider switching to JNI-based decompressor implementations as an interim measure (these are not affected)
• Implement explicit buffer clearing before reuse as a defense-in-depth measure

Patch Information

The vulnerability has been fixed in lz4-java version 1.10.1. The fix ensures proper clearing of output buffers in Java-based decompressor implementations, preventing information leakage through buffer reuse. Technical details of the fix are available in the GitHub commit, and the full security advisory is documented in the GitHub Security Advisory GHSA-cmp6-m4wj-q63q.

Organizations should update their Maven or Gradle dependencies to reference version 1.10.1 or later:

<!-- Maven dependency update -->
<dependency>
    <groupId>io.github.yawkat</groupId>
    <artifactId>lz4-java</artifactId>
    <version>1.10.1</version>
</dependency>

Workarounds

• Explicitly clear output buffers using Arrays.fill() before each decompression operation
• Allocate new buffers for each decompression operation instead of reusing existing buffers
• Switch to JNI-based decompressor implementations which are not affected by this vulnerability
• Implement input validation to reject malformed or suspicious LZ4 compressed data at application boundaries