PT-2025-51030 · Unknown · Aircompressor

Published 2025-12-12 · Updated 2026-05-18 · CVE-2025-67721

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Aircompressor versions 3.3 and below

Description Aircompressor is a Java library providing ports of Snappy, LZO, LZ4, and Zstandard compression algorithms. Incorrect handling of malformed data in the Java-based decompressor implementations for Snappy and LZ4 allows remote attackers to read previous buffer contents via crafted compressed input. With specific crafted compressed inputs, elements from the output buffer can appear in the uncompressed output, potentially exposing sensitive data. This is particularly relevant for applications that reuse the same output buffer for multiple decompression operations, such as web servers utilizing fixed-size buffers for performance.

Recommendations Update to version 3.4 or later.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

CWE-201

Related Identifiers

CLEANSTART-2026-DO09088

CLEANSTART-2026-HQ78610

CLEANSTART-2026-RM01950

CVE-2025-67721

GHSA-VX9Q-RHV9-3JVG

Affected Products

Aircompressor

References · 51

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67721.json · Exploit
• https://github.com/airlift/aircompressor/commit/ff12c4d5757c9d6d1de3d39a10402f1f84f9b765 · Patch
• https://github.com/airlift/aircompressor/security/advisories/GHSA-vx9q-rhv9-3jvg · Vendor Advisory
• https://github.com/airlift/aircompressor/commit/f2b489b398779b40c1ee29ddb11d7edef54ddc15 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-61726 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-68119 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-61730 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-67721 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39826 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-DO09088 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42499 · Security Note
• https://osv.dev/vulnerability/GHSA-vx9q-rhv9-3jvg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-67721 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27142 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-HQ78610 · Vendor Advisory