CVE-2025-67721
HIGH
GHSA-vx9q-rhv9-3jvg
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3Description
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. In versions 3.3 and below, incorrect handling of malformed data in Java-based decompressor implementations for Snappy and LZ4 allow remote attackers to read previous buffer contents via crafted compressed input. With certain crafted compressed inputs, elements from the output buffer can end up in the uncompressed output, potentially leaking sensitive data. This is relevant for applications that reuse the same output buffer to uncompress multiple inputs. This can be the case of a web server that allocates a fix-sized buffer for performance purposes. There is similar vulnerability in GHSA-cmp6-m4wj-q63q. This issue is fixed in version 3.4.
Analysis
A buffer information disclosure vulnerability exists in the Aircompressor Java compression library affecting Snappy and LZ4 decompressor implementations. Versions 3.3 and below of Airlift Aircompressor allow remote attackers to read previous buffer contents through crafted compressed input, potentially leaking sensitive data from applications that reuse output buffers across multiple decompression operations. With an EPSS score of 0.19% (41st percentile), active exploitation appears low probability despite the network-accessible attack vector, and no public proof-of-concept is currently documented.
Technical Context
Aircompressor is a Java library providing ports of popular compression algorithms including Snappy, LZ4, LZO, and Zstandard. The affected products are identified via CPE strings cpe:2.3:a:airlift:aircompressor:*:*:*:*:*:*:*:* covering all versions through 3.3. The vulnerability stems from CWE-125 (Out-of-bounds Read), where the decompressor implementations for Snappy and LZ4 incorrectly handle malformed compressed data. When processing crafted input, the decompressors fail to properly initialize or validate output buffer boundaries, allowing residual data from previous decompression operations to leak into the current output. This is particularly critical in high-performance scenarios where applications allocate fixed-size buffers and reuse them across multiple decompression cycles to minimize memory allocation overhead, such as in web servers handling multiple client requests with the same buffer instance.
Affected Products
Airlift Aircompressor versions 3.3 and below are affected by this vulnerability. The CPE identifiers cpe:2.3:a:airlift:aircompressor:*:*:*:*:*:*:*:* confirm all versions up to and including 3.3 contain the vulnerable Snappy and LZ4 decompressor implementations. This impacts any Java application using the Aircompressor library for decompression operations, particularly those in web server or network service contexts where buffer reuse is common for performance optimization. The official security advisory is available at https://github.com/airlift/aircompressor/security/advisories/GHSA-vx9q-rhv9-3jvg with additional tracking at https://vuldb.com/?id.336359.
Remediation
Upgrade Airlift Aircompressor to version 3.4 or later, which contains fixes for the buffer information disclosure vulnerability as documented in the vendor advisory at https://github.com/airlift/aircompressor/security/advisories/GHSA-vx9q-rhv9-3jvg. The patches are implemented in commits f2b489b398779b40c1ee29ddb11d7edef54ddc15 and ff12c4d5757c9d6d1de3d39a10402f1f84f9b765 available at https://github.com/airlift/aircompressor/commit/f2b489b398779b40c1ee29ddb11d7edef54ddc15 and https://github.com/airlift/aircompressor/commit/ff12c4d5757c9d6d1de3d39a10402f1f84f9b765. If immediate patching is not feasible, implement workarounds including: allocating fresh output buffers for each decompression operation instead of reusing buffers, implementing strict input validation to reject potentially malformed compressed data, and restricting decompression operations to trusted data sources only. For web applications, consider implementing additional security controls such as sandboxing decompression operations and monitoring for unusual decompression patterns that might indicate exploitation attempts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today