CVE-2025-67721
Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.
- Record
CVE-2025-67721- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-201, CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2025-203174
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.
- Record
EUVD-2025-203174- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-vx9q-rhv9-3jvg
aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
Summary
Incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data.
Details
With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. This is similar to GHSA-cmp6-m4wj-q63q.
Impact
Applications using aircompressor as described above may leak sensitive information to external unauthorized attackers.
Mitigation
The vulnerability is fixed in release 3.4 and 2.0.3. However, it can be mitigated by either:
- Avoiding reuse of the decompression buffer across calls
- Clearing the decompression buffer before a call to decompress data
- Record
GHSA-vx9q-rhv9-3jvg- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-125, CWE-201
- Updated
- 2026-11-02
NVD
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.
- Record
CVE-2025-67721- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-125, CWE-201
- Updated
- 2026-11-02
OSV
Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.
- Record
CVE-2025-67721- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-125, CWE-201
- Updated
- 2026-11-02
OSVGHSA-vx9q-rhv9-3jvg
aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
Summary
Incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data.
Details
With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. This is similar to GHSA-cmp6-m4wj-q63q.
Impact
Applications using aircompressor as described above may leak sensitive information to external unauthorized attackers.
Mitigation
The vulnerability is fixed in release 3.4 and 2.0.3. However, it can be mitigated by either:
- Avoiding reuse of the decompression buffer across calls
- Clearing the decompression buffer before a call to decompress data
- Record
GHSA-vx9q-rhv9-3jvg- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-125, CWE-201
- Updated
- 2026-11-02
Show 7 moreShow less
OSVRHLW-2026-5d649d9a9a6d6709
Lightwell Security Advisory: aircompressor 0.26.0.rhlw-00002
Red Hat Lightwell has released io.airlift:aircompressor 0.26.0.rhlw-00002 with backported fixes for CVE-2024-36114 and CVE-2025-67721.
CVE-2024-36114: Decompressors can crash the JVM and leak memory content in Aircompressor
CVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
This patched artifact is a drop-in replacement for io.airlift:aircompressor 0.26.0 from Maven Central.
- Record
RHLW-2026-5d649d9a9a6d6709- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-06
OSVRHLW-2026-a9a544137749200c
Lightwell Security Advisory: aircompressor 2.0.2.rhlw-00001
Red Hat Lightwell has released io.airlift:aircompressor 2.0.2.rhlw-00001 with a backported security fix.
CVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
This patched artifact is a drop-in replacement for io.airlift:aircompressor 2.0.2 from Maven Central.
- Record
RHLW-2026-a9a544137749200c- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-06
OSVRHLW-2026-df2f019d2581b594
Lightwell Security Advisory: aircompressor 0.27.0.rhlw-00003
Red Hat Lightwell has released io.airlift:aircompressor 0.27.0.rhlw-00003 with a backported security fix.
CVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
This patched artifact is a drop-in replacement for io.airlift:aircompressor 0.27.0 from Maven Central.
- Record
RHLW-2026-df2f019d2581b594- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-06
OSVCLSA-2026-1775521829 No score
TuxCare security update for io.airlift:aircompressor (1 CVE)
TuxCare rebuilt io.airlift:aircompressor to address 1 CVE. Fixed in 0.27-tuxcare.1.
- Record
CLSA-2026-1775521829- Updated
- 2026-11-02
OSVCLSA-2026-1791306781 No score
TuxCare security update for io.airlift:aircompressor (1 CVE)
TuxCare rebuilt io.airlift:aircompressor to address 1 CVE. Fixed in 0.20-tuxcare.2.
- Record
CLSA-2026-1791306781- Updated
- 2026-11-02
OSVCLSA-2026-1792010896 No score
TuxCare security update for io.airlift:aircompressor (1 CVE)
TuxCare rebuilt io.airlift:aircompressor to address 1 CVE. Fixed in 0.10-tuxcare.2.
- Record
CLSA-2026-1792010896- Updated
- 2026-11-02
OSVCLSA-2026-1793127929 No score
TuxCare security update for io.airlift:aircompressor (1 CVE)
TuxCare rebuilt io.airlift:aircompressor to address 1 CVE. Fixed in 0.21-tuxcare.2.
- Record
CLSA-2026-1793127929- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
io.airlift:aircompressor-v3Maven |
before 3.4 | 3.4 |
io.airlift:aircompressorMaven |
before 2.0.3 | 2.0.3 |
io.airlift:aircompressorTuxCare:Maven |
0.27 up to 0.27-tuxcare.1 | 0.27-tuxcare.1 |
io.airlift:aircompressorTuxCare:Maven |
0.20 up to 0.20-tuxcare.2, plus listed versions 0.20-tuxcare.1 |
0.20-tuxcare.2 |
io.airlift:aircompressorTuxCare:Maven |
0.10 up to 0.10-tuxcare.2, plus listed versions 0.10-tuxcare.1 |
0.10-tuxcare.2 |
io.airlift:aircompressorTuxCare:Maven |
0.21 up to 0.21-tuxcare.2, plus listed versions 0.21-tuxcare.1 |
0.21-tuxcare.2 |
io.airlift:aircompressor-v3Maven |
before 3.4, plus listed versions 3.03.13.23.3 |
3.4 |
io.airlift:aircompressorMaven |
before 2.0.3, plus listed versions 0.100.110.120.130.14 Show 23 moreShow less0.150.160.170.180.190.200.210.220.230.240.250.260.270.30.40.50.60.70.80.92.02.0.12.0.2 |
2.0.3 |
io.airlift:aircompressorRed Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 0.26.0.rhlw-00002, plus listed versions 0.100.110.120.130.14 Show 20 moreShow less0.150.160.170.180.190.200.210.220.230.240.250.260.26.00.30.40.50.60.70.80.9 |
0.26.0.rhlw-00002 |
io.airlift:aircompressorRed Hat Lightwell:Maven |
2.0.2 up to 2.0.2.rhlw-00001 | 2.0.2.rhlw-00001 |
io.airlift:aircompressorRed Hat Lightwell:Maven |
0.27.0 up to 0.27.0.rhlw-00003, plus listed versions 0.27 |
0.27.0.rhlw-00003 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-67721 is a medium vulnerability (CVSS 6.3) in Airlift Aircompressor, published December 12, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in io.airlift:aircompressor-v3 3.4.
References
github.com/airlift/aircompressor/security/advisories/GHSA-vx9q-rhv9-3jvg
nvd.nist.gov/vuln/detail/CVE-2025-67721
Show 11 moreShow less