CVE-2025-67721: Airlift Aircompressor Info Disclosure Bug

CVE-2025-67721 Overview

CVE-2025-67721 affects Aircompressor, a Java library implementing ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms. Versions 3.3 and below mishandle malformed compressed input in the Java-based Snappy and LZ4 decompressors. Remote attackers can craft compressed payloads that cause the decompressor to leak previous contents of the output buffer into the uncompressed result. Applications that reuse a single fixed-size output buffer across multiple decompression calls, such as high-performance web servers, are the most exposed. This behavior can expose sensitive data previously stored in the buffer to attacker-controlled decompression flows. The issue is fixed in Aircompressor 3.4.

Critical Impact
Remote attackers can leak residual contents of shared output buffers, potentially exposing sensitive data processed by other requests in the same application.

Affected Products

Airlift Aircompressor versions 3.3 and below
Java applications using Lz4RawDecompressor
Java applications using SnappyRawDecompressor

Discovery Timeline

2025-12-12 - CVE-2025-67721 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-67721

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] in the LZ4 and Snappy decompression routines. Both algorithms use back-references that copy earlier bytes from the output buffer into the current position. When the match offset is zero or otherwise invalid, the decompressor reads from uninitialized or stale regions of the output buffer instead of rejecting the input. Applications that reuse the same output buffer across successive decompression operations retain data from prior calls in those regions. A crafted compressed input can therefore steer the decompressor into copying that residual data into the current output, causing it to appear as valid decompressed bytes.

Root Cause

In Lz4RawDecompressor, the boundary check only compared matchAddress against outputAddress, permitting a match address equal to or beyond the current write position. In SnappyRawDecompressor, the guard used matchOffset < 0 instead of matchOffset <= 0, allowing a zero offset to bypass validation. Both flaws let malformed inputs reference bytes that were never written by the current decompression pass.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker submits a crafted compressed payload to any endpoint that decompresses Snappy or LZ4 data using Aircompressor. When the target application reuses a fixed output buffer for performance, the malformed input causes prior buffer contents to be emitted as decompressed output and returned to or observable by the attacker.

java

// Patch: Lz4RawDecompressor.java - reject match addresses past current write pointer
input += SIZE_OF_SHORT;

long matchAddress = output - offset;
-if (matchAddress < outputAddress) {
+if (matchAddress < outputAddress || matchAddress >= output) {
    throw new MalformedInputException(input - inputAddress, "offset outside destination buffer");
}
// Source: https://github.com/airlift/aircompressor/commit/f2b489b398779b40c1ee29ddb11d7edef54ddc15

java

// Patch: SnappyRawDecompressor.java - reject zero match offset
// bit 8).
int matchOffset = entry & 0x700;
matchOffset += trailer;
-if (matchOffset < 0) {
+if (matchOffset <= 0) {
    throw new MalformedInputException(input - inputAddress);
}
// Source: https://github.com/airlift/aircompressor/commit/ff12c4d5757c9d6d1de3d39a10402f1f84f9b765

Detection Methods for CVE-2025-67721

Indicators of Compromise

Application logs showing repeated MalformedInputException events from io.airlift.compress packages after upgrading to 3.4.
Unexpected byte sequences or fragments of prior request data appearing in decompressed output returned to clients.
Anomalous compressed payloads containing LZ4 back-references with match offsets pointing at or beyond the current write position.

Detection Strategies

Perform software composition analysis (SCA) on Java projects to identify io.airlift:aircompressor versions at or below 3.3.
Inspect dependency manifests (pom.xml, build.gradle) and container images for vulnerable Aircompressor JARs.
Add runtime instrumentation to log decompression failures and correlate them with client identity and request source.

Monitoring Recommendations

Monitor endpoints that accept Snappy or LZ4 compressed input for elevated rates of malformed-input errors.
Alert on responses containing decompressed content that fails downstream schema or content-type validation.
Track output buffer reuse patterns in application code paths that call SnappyRawDecompressor or Lz4RawDecompressor.

How to Mitigate CVE-2025-67721

Immediate Actions Required

Upgrade io.airlift:aircompressor to version 3.4 or later across all Java services and container images.
Audit application code for reuse of decompression output buffers and, where possible, zero the buffer before each call.
Restrict acceptance of Snappy and LZ4 compressed input to authenticated, trusted producers where feasible.

Patch Information

The fix is delivered in Aircompressor 3.4. Two commits implement the corrections: Lz4RawDecompressor patch tightens the match-address bounds check, and SnappyRawDecompressor patch rejects a zero match offset. Full details are available in the GitHub Security Advisory GHSA-vx9q-rhv9-3jvg.

Workarounds

Allocate a fresh output buffer for each decompression call instead of reusing a shared fixed-size buffer.
Explicitly zero the output buffer before invoking Snappy or LZ4 decompression when reuse cannot be avoided.
Validate decompressed output against expected schemas and drop responses that fail structural checks.

bash

# Maven: pin Aircompressor to a fixed version
mvn versions:use-dep-version -Dincludes=io.airlift:aircompressor -DdepVersion=3.4 -DforceVersion=true

# Gradle: enforce version in build.gradle
# implementation('io.airlift:aircompressor') { version { strictly '3.4' } }