CVE-2025-12183: LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

November 28, 2025 (updated December 31, 2025)

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

This is fixed in a forked release: at.yawk.lz4:lz4-java version 1.8.1. The original project has been archived: https://github.com/lz4/lz4-java, and Sonatype has added a redirect from org.lz4:lz4-java:1.8.1 to the new group ID.

References

github.com/advisories/GHSA-vqf4-7m7x-wgfc
github.com/yawkat/lz4-java
github.com/yawkat/lz4-java/releases/tag/v1.8.1
nvd.nist.gov/vuln/detail/CVE-2025-12183
sites.google.com/sonatype.com/vulnerabilities/cve-2025-12183
www.sonatype.com/security-advisories/cve-2025-12183

Code Behaviors & Features

Detect and mitigate CVE-2025-12183 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →