Discontinued Library: High-Severity lz4-java Flaw (CVE‐2025‐12183) Forces Immediate Migration to Community Fork

A high-severity vulnerability, CVE-2025-12183, has been disclosed in the lz4-java compression library, exposing applications to potential Denial of Service and sensitive information disclosure. The flaw is classified as an “Out-of-bounds Read” (CWE-125) and stems from insufficient memory access guards in the library’s compression and decompression implementations, with a CVSS score of 8.8. Because the original project has been discontinued, the community has migrated to a fork for security patches.

The vulnerability affects specific Maven coordinates up to and including version 1.8.0, namely org.lz4:lz4-java (≤ 1.8.0), org.lz4:lz4-pure-java (≤ 1.8.0) and net[.]jpountz.lz4:lz4 (≤ 1.8.0). Developers are urged to migrate to the new artifacts published under the group ID at[.]yawk.lz4, with Version 1.8.1 introducing the minimum security fixes and Version 1.9.0 adding non-security updates; a relocation POM will redirect from org.lz4:lz4-java:1.8.1 to the new artifact.

As a temporary workaround, code can switch from fastDecompressor() or fastestInstance() to safeInstance() or safeDecompressor(), with safeDecompressor() reportedly not vulnerable and potentially offering better long-term performance.