CVE-2025-67721 Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
Remote attackers can leak sensitive data from reused output buffers in Aircompressor's Snappy and LZ4 decompressors via crafted compressed input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-67721?
CVE-2025-67721 is a medium-severity vulnerability in airlift aircompressor, published on 12 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.
Which versions are affected by CVE-2025-67721?
4 open source packages ship an affected version, including io.airlift:aircompressor and io.airlift:aircompressor-v3. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
io.airlift:aircompressor Maven | All versions | 2.0.3 |
io.airlift:aircompressor Maven | All versions | 2.0.3 |
io.airlift:aircompressor-v3 Maven | All versions | 3.4 |
io.airlift:aircompressor-v3 Maven | All versions | 3.4 |
Products include Airlift Aircompressor.
How do I fix CVE-2025-67721?
Upgrade io.airlift:aircompressor to 2.0.3 or later.
Is CVE-2025-67721 being exploited?
There is no known exploitation of CVE-2025-67721 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-GC04122, CLEANSTART-2026-SD37188, CLSA-2026-1775521829, CLSA-2026-1791306781, CLSA-2026-1792010896, CLSA-2026-1793127929 and 16 more.