Maven/io.airlift:aircompressor-v3 CVE-2025-67721: high 7.5, EPSS 0.53%

aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer

Action: Upgrade io.airlift:aircompressor-v3 to 3.4 or later.

Affected

Fixed versions

Sources

• osv: GHSA-vx9q-rhv9-3jvg
• nvd: CVE-2025-67721
• https://github.com/airlift/aircompressor/security/advisories/GHSA-vx9q-rhv9-3jvg
• https://github.com/airlift/aircompressor/pull/309
• https://github.com/airlift/aircompressor/commit/f2b489b398779b40c1ee29ddb11d7edef54ddc15
• https://github.com/airlift/aircompressor/commit/ff12c4d5757c9d6d1de3d39a10402f1f84f9b765
• https://github.com/airlift/aircompressor
• https://github.com/airlift/aircompressor/releases/tag/2.0.3

CVE-2025-67721 · published 2025-12-12T22:12:22Z · modified 2026-09-10T03:50:32.261397070Z · JSON