What is the CVSS score of CVE-2025-67721?

CVE-2025-67721 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Java are affected by CVE-2025-67721?

Organizations using Aircompressor face notable risk from CVE-2025-67721, a out-of-bounds read vulnerability rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-67721?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Java CVE-2025-67721

HIGH

Out-of-bounds Read (CWE-125)

2025-12-12 security-advisories@github.com

GHSA-vx9q-rhv9-3jvg

Java Information Disclosure Buffer Overflow Aircompressor

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:45 vuln.today

Patch released

Mar 17, 2026 - 20:45 nvd

Patch available

CVE Published

Dec 12, 2025 - 23:15 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

396 maven packages depend on io.airlift:aircompressor (33 direct, 363 indirect)
9 maven packages depend on io.airlift:aircompressor-v3 (6 direct, 3 indirect)

Ecosystem-wide dependent count for version 2.0.3 and other introduced versions.

DescriptionGitHub Advisory

Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.

AnalysisAI

A buffer information disclosure vulnerability exists in the Aircompressor Java compression library affecting Snappy and LZ4 decompressor implementations. Versions 3.3 and below of Airlift Aircompressor allow remote attackers to read previous buffer contents through crafted compressed input, potentially leaking sensitive data from applications that reuse output buffers across multiple decompression operations. With an EPSS score of 0.19% (41st percentile), active exploitation appears low probability despite the network-accessible attack vector, and no public proof-of-concept is currently documented.

Technical ContextAI

Aircompressor is a Java library providing ports of popular compression algorithms including Snappy, LZ4, LZO, and Zstandard. The affected products are identified via CPE strings cpe:2.3:a:airlift:aircompressor:*:*:*:*:*:*:*:* covering all versions through 3.3. The vulnerability stems from CWE-125 (Out-of-bounds Read), where the decompressor implementations for Snappy and LZ4 incorrectly handle malformed compressed data. When processing crafted input, the decompressors fail to properly initialize or validate output buffer boundaries, allowing residual data from previous decompression operations to leak into the current output. This is particularly critical in high-performance scenarios where applications allocate fixed-size buffers and reuse them across multiple decompression cycles to minimize memory allocation overhead, such as in web servers handling multiple client requests with the same buffer instance.

RemediationAI

Upgrade Airlift Aircompressor to version 3.4 or later, which contains fixes for the buffer information disclosure vulnerability as documented in the vendor advisory at https://github.com/airlift/aircompressor/security/advisories/GHSA-vx9q-rhv9-3jvg. The patches are implemented in commits f2b489b398779b40c1ee29ddb11d7edef54ddc15 and ff12c4d5757c9d6d1de3d39a10402f1f84f9b765 available at https://github.com/airlift/aircompressor/commit/f2b489b398779b40c1ee29ddb11d7edef54ddc15 and https://github.com/airlift/aircompressor/commit/ff12c4d5757c9d6d1de3d39a10402f1f84f9b765. If immediate patching is not feasible, implement workarounds including: allocating fresh output buffers for each decompression operation instead of reusing buffers, implementing strict input validation to reject potentially malformed compressed data, and restricting decompression operations to trusted data sources only. For web applications, consider implementing additional security controls such as sandboxing decompression operations and monitoring for unusual decompression patterns that might indicate exploitation attempts.