PT-2025-51030 · Unknown · Aircompressor

CVE-2025-67721 · Published 2025-12-12 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aircompressor versions 3.3 and below

Description Aircompressor is a Java library providing ports of Snappy, LZO, LZ4, and Zstandard compression algorithms. Incorrect handling of malformed data in the Java-based decompressor implementations for Snappy and LZ4 allows remote attackers to read previous buffer contents via crafted compressed input. With specific crafted compressed inputs, elements from the output buffer can appear in the uncompressed output, potentially exposing sensitive data. This is particularly relevant for applications that reuse the same output buffer for multiple decompression operations, such as web servers utilizing fixed-size buffers for performance.

Recommendations Update to version 3.4 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-201

CWE-125

Related Identifiers

CLEANSTART-2026-BO52019

CLEANSTART-2026-DO09088

CLEANSTART-2026-DT81884

CLEANSTART-2026-EG39405

CLEANSTART-2026-GX44743

CLEANSTART-2026-HQ78610

CLEANSTART-2026-RM01950

CLEANSTART-2026-VP53607

CVE-2025-67721

GHSA-VX9Q-RHV9-3JVG

Affected Products

Aircompressor

References · 107

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67721.json · Exploit
• https://github.com/airlift/aircompressor/commit/ff12c4d5757c9d6d1de3d39a10402f1f84f9b765 · Patch
• https://github.com/airlift/aircompressor/commit/f2b489b398779b40c1ee29ddb11d7edef54ddc15 · Patch
• https://github.com/airlift/aircompressor/security/advisories/GHSA-vx9q-rhv9-3jvg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-46340 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-EG39405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42586 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44248 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42504 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61732 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42580 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41417 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25679 · Security Note