An Information Disclosure vulnerability (CVE-2025-66566) exists in the yawkat LZ4 Java library used by Elasticsearch that allows attackers to read previous buffer contents through specially crafted compressed input sent via the transport layer. The vulnerability affects Elasticsearch versions 7.14.0+ through 7.17.29, 8.0.0+ through 8.19.9, and multiple 9.x versions. Users should upgrade to versions 8.19.10, 9.1.10, or 9.2.4. Workarounds include switching to deflate compression or disabling compression entirely. The vulnerability has a high CVSS score of 8.4.