CVE-2025-12183: About official lz4-java library (2nd Dec 2025)

Published: 2025-11-28

Preface: Apache Hadoop and Apache Spark are both prominent and widely used frameworks for big data analytics. They are central to the processing and analysis of large datasets that cannot be handled by traditional data processing tools.

Apache Hadoop utilizes the MapReduce programming model as a core component for processing and analyzing large datasets in a distributed manner.

How memory is used in Hadoop? Application MemoryHadoop applications, such as those running on YARN (Yet Another Resource Negotiator), also utilize RAM for their processing needs. For instance, MapReduce tasks and Spark applications perform computations in memory, leveraging RAM for faster data access and processing.

Background: LZ4 is a very fast lossless compression algorithm, providing compression speed > 500 MB/s per core, scalable with multi-cores CPU. It also features an extremely fast decoder, with speed in multiple GB/s per core, typically reaching RAM speed limits on multi-core systems.

The liblz4-java[.]so file is a native shared library that provides the underlying LZ4 compression and decompression functionality for the lz4-java library in Java applications.

From technical point of view,  liblz4-java[.]so acts as the high-performance engine for LZ4 operations, while the Java lz4-java library provides a convenient and type-safe API for Java developers to interact with this engine.

Remark: Since the maintainers of the official lz4-java library could not be contacted, the lz4 organization decided to discontinue the project.

Vulnerability details:

CVE-2025-12183 – Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

Official announcement: Please refer to the link for details –

https://www.tenable.com/cve/CVE-2025-12183

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.