[CVE-2025-12183] HIGH: lz4-java 1.8.0 - Out-of-bounds memory and information disclosure

[nthmost-orkes]

Vulnerability Report

Field	Value
CVEs	CVE-2025-12183, CVE-2025-66566
Severity	HIGH (2 CVEs)
Library	org.lz4:lz4-java
Source	workers.jar
Installed Version	1.8.0
Fixed Version	1.8.1 (CVE-2025-12183); unknown (CVE-2025-66566)

Summary

Two vulnerabilities in lz4-java:

1. CVE-2025-12183 - Out-of-bounds memory operations lead to denial of service and information disclosure
2. CVE-2025-66566 - Information Disclosure via Insufficient Output Buffer Clearing

References

• CVE-2025-12183
• CVE-2025-66566

---

Filed from container vulnerability scan of workers.jar

[nthmost-orkes]

Fix PR: conductor-oss/conductor#800 (pins lz4-java to 1.8.1 via Gradle dependency constraints)