Skip to content
OpenAdvisories
Medium · 6.3 CVE-2025-67721 EUVD-2025-203174GHSA-vx9q-rhv9-3jvg

Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer

Published Dec 12, 2025 · Updated Dec 15, 2025 · Assigned by GitHub_M

Vendor: airlift Product: aircompressor Package: apache-nifi Package: druid Package: io.airlift:aircompressor Package: io.airlift:aircompressor-v3 Package: neo4j-2025.10 Package: spark-4.0-scala-2.13 Package: spark-4.1-scala-2.13 Package: trino Package: trino-config Package: trino-oci-entrypoint Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-http-server-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-teradata-functions Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: trino-plugin-vertica Ecosystem: Maven Ecosystem: Wolfi

Description

Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.

Affected products

VendorProductAffectedFixed
airlift aircompressor < 3.4 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling apache-nifi 2.8.0-r0 —
Wolfi rolling druid 36.0.0-r10 —
Wolfi rolling neo4j-2025.10 No fix yet —
Wolfi rolling spark-4.0-scala-2.13 4.0.3-r0 —
Wolfi rolling spark-4.1-scala-2.13 4.1.2-r0 —
Wolfi rolling trino +58 478-r4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven io.airlift:aircompressor < 2.0.3 2.0.3 GHSA-vx9q-rhv9-3jvg
Maven io.airlift:aircompressor-v3 < 3.4 3.4 GHSA-vx9q-rhv9-3jvg

Advisories 2

References