# CVE-2025-12183: LZ4 Java Compression has Out-of-bounds memory operations which can cause DoS

Source: https://junglewise.ai/threats/cve-2025-12183-lz4-java-compression-has-out-of-bounds-memory-operations-which  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-28  
License: CC BY 4.0 with a link back

CVE-2025-12183 · Severity: medium · CVSS 4 · Published 2025-11-28

Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Technologies: [at.yawk.lz4:lz4-java (Maven)](https://junglewise.ai/threats/technologies/at-yawk-lz4-lz4-java), [org.lz4:lz4-java (Maven)](https://junglewise.ai/threats/technologies/org-lz4-lz4-java). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2025-12183 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-12183 being exploited in the wild.

**How severe is CVE-2025-12183?** Medium severity, with a CVSS score of 4, published 28 November 2025.

**Which products and versions are affected?** at.yawk.lz4:lz4-java (Maven) ECOSYSTEM:introduced=0,fixed=1.8.1; net.jpountz.lz4:lz4 (Maven) ECOSYSTEM:introduced=0,last_affected=1.3.0; org.lz4:lz4-java (Maven) ECOSYSTEM:introduced=0,fixed=1.8.1; org.lz4:lz4-pure-java (Maven) ECOSYSTEM:introduced=0,last_affected=1.8.0.

**Is there a fix for CVE-2025-12183?** Yes. at.yawk.lz4:lz4-java (Maven): upgrade to 1.8.1 or later; org.lz4:lz4-java (Maven): upgrade to 1.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-12183?** Check whether you run at.yawk.lz4:lz4-java (Maven), net.jpountz.lz4:lz4 (Maven), org.lz4:lz4-java (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- at.yawk.lz4:lz4-java (Maven): upgrade to 1.8.1 or later

  ```sh
  # set at.yawk.lz4:lz4-java to 1.8.1 in your pom.xml or build.gradle
  ```

- org.lz4:lz4-java (Maven): upgrade to 1.8.1 or later

  ```sh
  # set org.lz4:lz4-java to 1.8.1 in your pom.xml or build.gradle
  ```


## Affected products

- at.yawk.lz4:lz4-java (Maven) ECOSYSTEM:introduced=0,fixed=1.8.1
- net.jpountz.lz4:lz4 (Maven) ECOSYSTEM:introduced=0,last_affected=1.3.0
- org.lz4:lz4-java (Maven) ECOSYSTEM:introduced=0,fixed=1.8.1
- org.lz4:lz4-pure-java (Maven) ECOSYSTEM:introduced=0,last_affected=1.8.0

## Identifiers

- CVE-2025-12183
- GHSA-vqf4-7m7x-wgfc

## Related threats

- [yawkat LZ4 Java heap exhaustion in decompressor](https://junglewise.ai/threats/cve-2026-106453-yawkat-lz4-java-provides-lz4-compression-for-java-prior-to-1-11)
- [yawkat LZ4 Java heap exhaustion in LZ4BlockInputStream](https://junglewise.ai/threats/cve-2026-106452-yawkat-lz4-java-provides-lz4-compression-for-java-prior-to-1-11)
- [yawkat LZ4 Java insecure temporary file handling in native library loading](https://junglewise.ai/threats/cve-2026-106451-yawkat-lz4-java-provides-lz4-compression-for-java-from-1-7-0)
- [yawkat LZ4 Java resource exhaustion in LZ4FrameInputStream](https://junglewise.ai/threats/cve-2026-106450-yawkat-lz4-java-provides-lz4-compression-for-java-prior-to-1-11)
- [yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=false recurses once per empty block, causing StackOverflowError](https://junglewise.ai/threats/cve-2026-106449-yawkat-lz4-java-provides-lz4-compression-for-java-prior-to-1-11)