cve.nowby Sazabi

MavenPackage

net.jpountz.lz4:lz4

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release: 1.3 (Nov 26, 2014): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 2 · 2 high

Dependents: 16
Releases: 7 since 1.0.0 (Jan 8, 2013)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2025-66566
Affects 1.0.0 to 1.3.0 (through the newest release)
CVE-2025-12183
Affects 1.0.0 to 1.3.0 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

CVE-2025-66566High 8.2
yawkat LZ4 Java has a possible information leak in Java safe decompressor
Affected: through 1.8.1.
No fix released. The latest release, 1.3, is still affected.
CVE-2025-12183High 8.8
org.lz4:lz4-java - Out-of-Bounds Memory Access
Affected: from 1.0.0, through 1.8.0; through 1.3.0.
No fix released. The latest release, 1.3, is still affected.