Data Leak Vulnerability in Aircompressor Library for Java-Based Decompressors

CVE-2025-67721

What is CVE-2025-67721?

The Aircompressor library, which implements various compression algorithms in Java, has a vulnerability in its handling of malformed data during decompression operations. Specifically, in versions 3.3 and below, an attacker can exploit this by sending crafted compressed input, resulting in unintended data leakage from previous buffer contents. This is particularly concerning for applications that utilize a fixed-size buffer for uncompression, such as web servers, as it may inadvertently output sensitive information from the buffer. Users are advised to upgrade to version 3.4 or later to mitigate this risk. Relevant issues are linked in various GitHub advisories.

References