{"id":"CVE-2025-67721","aliases":["CLSA-2026-1775521829","CLSA-2026-1791306781","CLSA-2026-1792010896","CLSA-2026-1793127929","EUVD-2025-203174","GHSA-vx9q-rhv9-3jvg","RHLW-2026-3813366f0e43c8bd","RHLW-2026-5d649d9a9a6d6709","RHLW-2026-a9a544137749200c","RHLW-2026-ddbf70570c599819","RHLW-2026-df2f019d2581b594"],"status":"published","title":"Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer","description":"Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00526,"percentile":0.45039,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-201"],"published":"2025-12-12T22:11:10Z","modified":"2026-11-10T23:00:02Z","fixes":[{"ecosystem":"Maven","package":"io.airlift:aircompressor-v3","fixed_in":["3.4"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"io.airlift:aircompressor","fixed_in":["2.0.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"io.airlift:aircompressor","fixed_in":["0.27-tuxcare.1","0.20-tuxcare.2","0.10-tuxcare.2","0.21-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Red Hat Lightwell:Maven","package":"io.airlift:aircompressor","fixed_in":["2.0.2.rhlw-00001","0.27.0.rhlw-00003"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"io.airlift:aircompressor-v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27"},{"fixed":"0.27-tuxcare.1"}]}],"versions":["0.27"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.20"},{"fixed":"0.20-tuxcare.2"}]}],"versions":["0.20","0.20-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.10"},{"fixed":"0.10-tuxcare.2"}]}],"versions":["0.10","0.10-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.21"},{"fixed":"0.21-tuxcare.2"}]}],"versions":["0.21","0.21-tuxcare.1"]},{"source":"osv","ecosystem":"Maven","package":"io.airlift:aircompressor-v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4"}]}],"versions":["3.0","3.1","3.2","3.3"]},{"source":"osv","ecosystem":"Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3"}]}],"versions":["0.10","0.11","0.12","0.13","0.14","0.15","0.16","0.17","0.18","0.19","0.20","0.21","0.22","0.23","0.24","0.25","0.26","0.27","0.3","0.4","0.5","0.6","0.7","0.8","0.9","2.0","2.0.1","2.0.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0.rhlw-00007"}]}],"versions":["0.10","0.11","0.12","0.13","0.14","0.15","0.16","0.17","0.18","0.19","0.20","0.21","0.21.0","0.3","0.4","0.5","0.6","0.7","0.8","0.9"],"bundled":2},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.26.0.rhlw-00002"}]}],"versions":["0.10","0.11","0.12","0.13","0.14","0.15","0.16","0.17","0.18","0.19","0.20","0.21","0.22","0.23","0.24","0.25","0.26","0.26.0","0.3","0.4","0.5","0.6","0.7","0.8","0.9"],"bundled":2},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.2"},{"fixed":"2.0.2.rhlw-00001"}]}],"versions":["2.0.2"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.25.0"},{"fixed":"0.25.0.rhlw-00005"}]}],"versions":["0.25","0.25.0"],"bundled":2},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"io.airlift:aircompressor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.27.0"},{"fixed":"0.27.0.rhlw-00003"}]}],"versions":["0.27","0.27.0"]}],"products":[{"vendor":"airlift","product":"aircompressor"}],"references":[{"url":"https://github.com/airlift/aircompressor/security/advisories/GHSA-vx9q-rhv9-3jvg","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web"]},{"url":"https://github.com/airlift/aircompressor/commit/f2b489b398779b40c1ee29ddb11d7edef54ddc15","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/airlift/aircompressor/commit/ff12c4d5757c9d6d1de3d39a10402f1f84f9b765","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67721","tags":["advisory"]},{"url":"https://github.com/airlift/aircompressor/pull/309","tags":["web"]},{"url":"https://github.com/airlift/aircompressor/releases/tag/2.0.3","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vx9q-rhv9-3jvg","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67721.json","tags":["advisory"]},{"url":"https://github.com/airlift/aircompressor","tags":["package"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36114.json","tags":["advisory"]},{"url":"https://github.com/airlift/aircompressor/security/advisories/GHSA-973x-65j7-xcf4","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36114","tags":["advisory"]},{"url":"https://github.com/airlift/aircompressor/commit/15e68df9eb0c2bfde7f796231ee7cd1982965071","tags":["fix"]},{"url":"https://github.com/airlift/aircompressor/commit/2cea90a45534f9aacbb77426fb64e975504dee6e","tags":["fix"]},{"url":"https://github.com/airlift/aircompressor/commit/cf66151541edb062ea88b6f3baab3f95e48b7b7f","tags":["fix"]},{"url":"https://github.com/airlift/aircompressor/commit/d01ecb779375a092d00e224abe7869cdf49ddc3e","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-973x-65j7-xcf4","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-67721","title":"Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer","description":"Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.","status":"published","published":"2025-12-12T22:11:10.971Z","modified":"2025-12-15T15:04:15.629Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-201","CWE-125"],"updated_at":"2026-11-02T14:32:52.21763Z"}],"euvd":[{"id":"EUVD-2025-203174","description":"Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.","status":"published","published":"2025-12-12T22:11:10Z","modified":"2025-12-15T15:04:15Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:05.447386Z"}],"ghsa":[{"id":"GHSA-vx9q-rhv9-3jvg","title":"aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer","description":"### Summary\nIncorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data.\n\n### Details\nWith certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. This is similar to [GHSA-cmp6-m4wj-q63q](https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q).\n\n### Impact\nApplications using aircompressor as described above may leak sensitive information to external unauthorized attackers.\n\n### Mitigation\n\nThe vulnerability is fixed in release 3.4 and 2.0.3. However, it can be mitigated by either:\n* Avoiding reuse of the decompression buffer across calls\n* Clearing the decompression buffer before a call to decompress data","status":"published","published":"2025-12-12T22:12:22Z","modified":"2026-02-25T15:32:29Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-125","CWE-201"],"updated_at":"2026-11-02T14:39:27.949248Z"}],"nvd":[{"id":"CVE-2025-67721","description":"Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.","status":"published","published":"2025-12-12T23:15:42.067Z","modified":"2026-10-07T20:10:01.97Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-125","CWE-201"],"updated_at":"2026-11-02T14:11:50.400521Z"}],"osv":[{"id":"CVE-2025-67721","title":"Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer","description":"Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.","status":"published","published":"2025-12-12T22:11:10.971Z","modified":"2026-10-28T11:06:22.563281974Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-125","CWE-201"],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"GHSA-vx9q-rhv9-3jvg","title":"aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer","description":"### Summary\nIncorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allows remote attackers to read previous buffer contents via crafted compressed input. In applications where the output buffer is reused without being cleared, this may lead to disclosure of sensitive data.\n\n### Details\nWith certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. This is similar to [GHSA-cmp6-m4wj-q63q](https://github.com/yawkat/lz4-java/security/advisories/GHSA-cmp6-m4wj-q63q).\n\n### Impact\nApplications using aircompressor as described above may leak sensitive information to external unauthorized attackers.\n\n### Mitigation\n\nThe vulnerability is fixed in release 3.4 and 2.0.3. However, it can be mitigated by either:\n* Avoiding reuse of the decompression buffer across calls\n* Clearing the decompression buffer before a call to decompress data","status":"published","published":"2025-12-12T22:12:22Z","modified":"2026-09-10T03:50:32.26139707Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-125","CWE-201"],"updated_at":"2026-11-02T15:46:58.04805Z"},{"id":"RHLW-2026-3813366f0e43c8bd","title":"Lightwell Security Advisory: aircompressor 0.21.0.rhlw-00007","description":"Red Hat Lightwell has released io.airlift:aircompressor 0.21.0.rhlw-00007 with backported fixes for CVE-2024-36114 and CVE-2025-67721.\n\nCVE-2024-36114: Decompressors can crash the JVM and leak memory content in Aircompressor\n\nCVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer\n\nThis patched artifact is a drop-in replacement for io.airlift:aircompressor 0.21.0 from Maven Central.","status":"published","published":"2026-11-06T17:21:37Z","modified":"2026-11-10T08:30:02.501919156Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-10T08:55:24.395105Z"},{"id":"RHLW-2026-5d649d9a9a6d6709","title":"Lightwell Security Advisory: aircompressor 0.26.0.rhlw-00002","description":"Red Hat Lightwell has released io.airlift:aircompressor 0.26.0.rhlw-00002 with backported fixes for CVE-2024-36114 and CVE-2025-67721.\n\nCVE-2024-36114: Decompressors can crash the JVM and leak memory content in Aircompressor\n\nCVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer\n\nThis patched artifact is a drop-in replacement for io.airlift:aircompressor 0.26.0 from Maven Central.","status":"published","published":"2026-11-05T14:39:30Z","modified":"2026-11-06T19:30:02.894833325Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-06T19:35:45.633414Z"},{"id":"RHLW-2026-a9a544137749200c","title":"Lightwell Security Advisory: aircompressor 2.0.2.rhlw-00001","description":"Red Hat Lightwell has released io.airlift:aircompressor 2.0.2.rhlw-00001 with a backported security fix.\n\nCVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer\n\nThis patched artifact is a drop-in replacement for io.airlift:aircompressor 2.0.2 from Maven Central.","status":"published","published":"2026-10-08T19:45:30Z","modified":"2026-11-06T19:30:02.896196894Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-06T19:35:45.633414Z"},{"id":"RHLW-2026-ddbf70570c599819","title":"Lightwell Security Advisory: aircompressor 0.25.0.rhlw-00005","description":"Red Hat Lightwell has released io.airlift:aircompressor 0.25.0.rhlw-00005 with backported fixes for CVE-2024-36114 and CVE-2025-67721.\n\nCVE-2024-36114: Decompressors can crash the JVM and leak memory content in Aircompressor\n\nCVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer\n\nThis patched artifact is a drop-in replacement for io.airlift:aircompressor 0.25.0 from Maven Central.","status":"published","published":"2026-11-09T22:21:43Z","modified":"2026-11-10T23:00:02.529291446Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-10T23:15:02.146439Z"},{"id":"RHLW-2026-df2f019d2581b594","title":"Lightwell Security Advisory: aircompressor 0.27.0.rhlw-00003","description":"Red Hat Lightwell has released io.airlift:aircompressor 0.27.0.rhlw-00003 with a backported security fix.\n\nCVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer\n\nThis patched artifact is a drop-in replacement for io.airlift:aircompressor 0.27.0 from Maven Central.","status":"published","published":"2026-11-05T14:40:31Z","modified":"2026-11-06T19:30:03.817145648Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-06T19:35:45.633414Z"},{"id":"CLSA-2026-1775521829","title":"TuxCare security update for io.airlift:aircompressor (1 CVE)","description":"TuxCare rebuilt io.airlift:aircompressor to address 1 CVE. Fixed in 0.27-tuxcare.1.","status":"published","published":"2026-08-04T14:52:22Z","modified":"2026-10-15T09:46:23.170992938Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1791306781","title":"TuxCare security update for io.airlift:aircompressor (1 CVE)","description":"TuxCare rebuilt io.airlift:aircompressor to address 1 CVE. Fixed in 0.20-tuxcare.2.","status":"published","published":"2026-10-06T17:13:01Z","modified":"2026-10-15T09:45:37.293467214Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792010896","title":"TuxCare security update for io.airlift:aircompressor (1 CVE)","description":"TuxCare rebuilt io.airlift:aircompressor to address 1 CVE. Fixed in 0.10-tuxcare.2.","status":"published","published":"2026-10-14T20:48:16Z","modified":"2026-10-15T09:47:34.720522771Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1793127929","title":"TuxCare security update for io.airlift:aircompressor (1 CVE)","description":"TuxCare rebuilt io.airlift:aircompressor to address 1 CVE. Fixed in 0.21-tuxcare.2.","status":"published","published":"2026-10-27T19:05:29Z","modified":"2026-10-28T01:45:04.504549951Z","updated_at":"2026-11-02T15:43:55.34846Z"}]}}