CVE-2025-12183 org.lz4:lz4-java - Out-of-Bounds Memory Access
Remote attackers can cause denial of service and read adjacent memory in the lz4-java library via untrusted compressed input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-12183?
CVE-2025-12183 is a high-severity memory corruption vulnerability in at.yawk.lz4:lz4-java, published on 28 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.
Weakness: CWE-125
Which versions are affected by CVE-2025-12183?
8 open source packages ship an affected version, including at.yawk.lz4:lz4-java, net.jpountz.lz4:lz4 and org.lz4:lz4-java.
| Package | Affected | Fixed in |
|---|---|---|
at.yawk.lz4:lz4-java Maven | All versions | 1.8.1 |
at.yawk.lz4:lz4-java Maven | All versions | 1.8.1 |
net.jpountz.lz4:lz4 Maven | All versions to 1.3.0 | None |
net.jpountz.lz4:lz4 Maven | All versions to 1.3.0 | None |
org.lz4:lz4-java Maven | All versions | 1.8.1 |
org.lz4:lz4-java Maven | All versions | 1.8.1 |
2 more packages
org.lz4:lz4-pure-java Maven | All versions to 1.8.0 | None |
org.lz4:lz4-pure-java Maven | All versions to 1.8.0 | None |
Linux distribution packages (1)
grype openSUSE:Tumbleweed | All versions | 0.109.1-1.1 |
How do I fix CVE-2025-12183?
Upgrade at.yawk.lz4:lz4-java to 1.8.1 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-12183 being exploited?
There is no known exploitation of CVE-2025-12183 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-GE42999, CLEANSTART-2026-KF94035, CLEANSTART-2026-PT41131, CLEANSTART-2026-QA75834, CLEANSTART-2026-SD29232, CLEANSTART-2026-TF05670 and 56 more.