CVE-2025-12183

org.lz4:lz4-java - Out-of-Bounds Memory Access

8.8 HighFix available

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: High

Exploit likelihood

0.75%Up 0.6 points since Nov 29, 2025

What each source reports

CVE List Score used 8.8

org.lz4:lz4-java - Out-of-Bounds Memory Access

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Record: CVE-2025-12183
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-125
Updated: 2026-11-02

EUVDEUVD-2025-199880 8.8

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Record: EUVD-2025-199880
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vqf4-7m7x-wgfc 8.8

LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

This is fixed in a forked release: at.yawk.lz4:lz4-java version 1.8.1. The original project has been archived: https://github.com/lz4/lz4-java, and Sonatype has added a redirect from org.lz4:lz4-java:1.8.1 to the new group ID.

Record: GHSA-vqf4-7m7x-wgfc
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-125
Updated: 2026-11-02

NVD 8.8

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Record: CVE-2025-12183
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-125
Updated: 2026-11-05

OSV 8.8

org.lz4:lz4-java - Out-of-Bounds Memory Access

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Record: CVE-2025-12183
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-125
Updated: 2026-11-05

OSVDEBIAN-CVE-2025-12183 8.8

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Record: DEBIAN-CVE-2025-12183
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-05

Show 7 moreShow less

OSVGHSA-vqf4-7m7x-wgfc 8.8

LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Record: GHSA-vqf4-7m7x-wgfc
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-125
Updated: 2026-11-02

OSVRHSA-2026:1870 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.4 security update

Record: RHSA-2026:1870
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2026:1871 7.5

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.4 security update

Record: RHSA-2026:1871
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVROOT-APP-MAVEN-CVE-2025-12183 6.5

CVE-2025-12183 in io.root.org.lz4:lz4-java - Patched by Root

Root has patched CVE-2025-12183 in the io.root.org.lz4:lz4-java package for Root:Maven. Multiple fixed versions available.

Record: ROOT-APP-MAVEN-CVE-2025-12183
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2025-12183 8.8

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Record: UBUNTU-CVE-2025-12183
CVSS 4.0: 8.8 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVCLSA-2026-1786627215 No score

TuxCare security update for org.lz4 (2 CVEs)

TuxCare rebuilt 2 org.lz4 packages to address 2 CVEs. Fixed in 1.8.0-tuxcare.1.

Record: CLSA-2026-1786627215
Updated: 2026-11-02

OSVopenSUSE-SU-2026:10317-1 No score

grype-0.109.1-1.1 on GA media

These are all security issues fixed in the grype-0.109.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2026:10317-1
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`at.yawk.lz4:lz4-java` Maven	before 1.8.1	1.8.1
`org.lz4:lz4-java` Maven	before 1.8.1	1.8.1
`org.lz4:lz4-pure-java` Maven	through 1.8.0	None known
`net.jpountz.lz4:lz4` Maven	through 1.3.0	None known
`org.lz4:lz4-java` TuxCare:Maven From an advisory covering 2 CVEs	1.8.0 up to 1.8.0-tuxcare.1	1.8.0-tuxcare.1
`org.lz4:lz4-pure-java` TuxCare:Maven From an advisory covering 2 CVEs	1.8.0 up to 1.8.0-tuxcare.1	1.8.0-tuxcare.1
`lz4-java` Debian:12	All versions, plus listed versions 1.11.2+ds1-11.11.2+ds1-21.11.2+ds1-31.8.0-31.8.0-4	None known
`lz4-java` Debian:13	All versions, plus listed versions 1.11.2+ds1-11.11.2+ds1-21.11.2+ds1-31.8.0-4	None known
`lz4-java` Debian:14	before 1.11.2+ds1-1, plus listed versions 1.8.0-4	1.11.2+ds1-1
`org.lz4:lz4-java` Maven	before 1.8.1, plus listed versions 1.41.4.01.4.11.5.01.5.1 Show 4 moreShow less 1.6.01.7.01.7.11.8.0	1.8.1

Show 21 moreShow less

Affected packages
Package	Affected	Fixed
`org.lz4:lz4-pure-java` Maven	through 1.8.0, plus listed versions 1.7.0	None known
`net.jpountz.lz4:lz4` Maven	through 1.3.0, plus listed versions 1.0.01.1.01.1.11.1.21.2.01.3	None known
`eap8-wildfly` Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 2 CVEs	before 0:8.1.4-2.GA_redhat_00005.1.el8eap	0:8.1.4-2.GA_redhat_00005.1.el8eap
`eap8-wildfly-java-jdk17` Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 2 CVEs	before 0:8.1.4-2.GA_redhat_00005.1.el8eap	0:8.1.4-2.GA_redhat_00005.1.el8eap
`eap8-wildfly-java-jdk21` Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 2 CVEs	before 0:8.1.4-2.GA_redhat_00005.1.el8eap	0:8.1.4-2.GA_redhat_00005.1.el8eap
`eap8-wildfly-modules` Red Hat:jboss_enterprise_application_platform:8.1::el8 From an advisory covering 2 CVEs	before 0:8.1.4-2.GA_redhat_00005.1.el8eap	0:8.1.4-2.GA_redhat_00005.1.el8eap
`eap8-wildfly` Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 2 CVEs	before 0:8.1.4-2.GA_redhat_00005.1.el9eap	0:8.1.4-2.GA_redhat_00005.1.el9eap
`eap8-wildfly-java-jdk17` Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 2 CVEs	before 0:8.1.4-2.GA_redhat_00005.1.el9eap	0:8.1.4-2.GA_redhat_00005.1.el9eap
`eap8-wildfly-java-jdk21` Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 2 CVEs	before 0:8.1.4-2.GA_redhat_00005.1.el9eap	0:8.1.4-2.GA_redhat_00005.1.el9eap
`eap8-wildfly-modules` Red Hat:jboss_enterprise_application_platform:8.1::el9 From an advisory covering 2 CVEs	before 0:8.1.4-2.GA_redhat_00005.1.el9eap	0:8.1.4-2.GA_redhat_00005.1.el9eap
`io.root.org.lz4:lz4-java` Root:Maven	before 1.8.0-root.io.7	1.8.0-root.io.71.8.0-root.io.81.8.0-root.io.91.8.1-root.io.11.8.1-root.io.2
`io.root.net.jpountz.lz4:lz4` Root:Maven	before 1.3.0-root.io.3	1.3.0-root.io.31.3.0-root.io.4
`net.jpountz.lz4:lz4` Root:Maven	before 1.3.0-aikido.4	1.3.0-aikido.4
`org.lz4:lz4-java` Root:Maven	before 1.8.0-aikido.9	1.8.0-aikido.9
`lz4-java` Ubuntu:20.04:LTS	All versions, plus listed versions 1.5.1-2	None known
`lz4-java` Ubuntu:22.04:LTS	All versions, plus listed versions 1.5.1-3build1	None known
`lz4-java` Ubuntu:24.04:LTS	All versions, plus listed versions 1.8.0-31.8.0-41.8.0-4build1	None known
`lz4-java` Ubuntu:25.10	All versions, plus listed versions 1.8.0-4build1	None known
`lz4-java` Ubuntu:26.10	All versions, plus listed versions 1.8.0-4build2	None known
`lz4-java` Ubuntu:26.04:LTS	All versions, plus listed versions 1.8.0-4build11.8.0-4build2	None known
`grype` openSUSE:Tumbleweed	before 0.109.1-1.1	0.109.1-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected	OSV
Nov 5, 2026	facts	NVD
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-12183 is a high vulnerability (CVSS 8.8) in org.lz4:lz4-java, published November 28, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in at.yawk.lz4:lz4-java 1.8.1.

References

Show 42 moreShow less