{"action":"Upgrade io.airlift:aircompressor to 2.0.3 or later.","affected":[{"fixed":"2.0.3","introduced":"0"}],"component":"io.airlift:aircompressor","cve_ids":["CVE-2025-67721"],"ecosystem":"Maven","epss":0.00526,"exploited":false,"fixed_versions":["2.0.3"],"ghsa_id":"GHSA-vx9q-rhv9-3jvg","id":"tcs_01M5N9F1ZTWBJ5P3E618BTVFEV","modified_at":"2026-09-10T03:50:32.261397070Z","published_at":"2025-12-12T22:12:22Z","references":["https://osv.dev/vulnerability/GHSA-vx9q-rhv9-3jvg","https://github.com/airlift/aircompressor/security/advisories/GHSA-vx9q-rhv9-3jvg","https://nvd.nist.gov/vuln/detail/CVE-2025-67721","https://github.com/airlift/aircompressor/pull/309","https://github.com/airlift/aircompressor/commit/f2b489b398779b40c1ee29ddb11d7edef54ddc15","https://github.com/airlift/aircompressor/commit/ff12c4d5757c9d6d1de3d39a10402f1f84f9b765","https://github.com/airlift/aircompressor","https://github.com/airlift/aircompressor/releases/tag/2.0.3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-vx9q-rhv9-3jvg#Maven/io.airlift:aircompressor","url":"https://osv.dev/vulnerability/GHSA-vx9q-rhv9-3jvg"},{"source":"nvd","source_id":"CVE-2025-67721","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67721"}],"summary":"aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer"}