{"action":"Upgrade io.airlift:aircompressor-v3 to 3.4 or later.","affected":[{"fixed":"3.4","introduced":"0"}],"component":"io.airlift:aircompressor-v3","cve_ids":["CVE-2025-67721"],"ecosystem":"Maven","epss":0.00526,"exploited":false,"fixed_versions":["3.4"],"ghsa_id":"GHSA-vx9q-rhv9-3jvg","id":"tcs_01M5N9F1VJ0Z5FANMHAS4CSF7E","modified_at":"2026-09-10T03:50:32.261397070Z","published_at":"2025-12-12T22:12:22Z","references":["https://osv.dev/vulnerability/GHSA-vx9q-rhv9-3jvg","https://github.com/airlift/aircompressor/security/advisories/GHSA-vx9q-rhv9-3jvg","https://nvd.nist.gov/vuln/detail/CVE-2025-67721","https://github.com/airlift/aircompressor/pull/309","https://github.com/airlift/aircompressor/commit/f2b489b398779b40c1ee29ddb11d7edef54ddc15","https://github.com/airlift/aircompressor/commit/ff12c4d5757c9d6d1de3d39a10402f1f84f9b765","https://github.com/airlift/aircompressor","https://github.com/airlift/aircompressor/releases/tag/2.0.3"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-vx9q-rhv9-3jvg","url":"https://osv.dev/vulnerability/GHSA-vx9q-rhv9-3jvg"}],"summary":"aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer"}