CVE-2025-67721: 
Java vulnerability analysis and mitigation

CVE-2025-67721 is an information disclosure vulnerability in the Aircompressor Java library affecting its Snappy and LZ4 decompressor implementations. Incorrect handling of malformed compressed data — specifically a zero match offset — causes the decompressor to read and return pre-existing contents of the output buffer, potentially leaking sensitive data from prior decompression operations. The vulnerability affects io.airlift:aircompressor versions before 2.0.3 and io.airlift:aircompressor-v3 versions 3.0 through 3.3 (before 3.4). It was disclosed on December 12, 2025, with a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.2 (High) (GitHub Advisory, Github Advisory).

The root cause is improper validation of the match offset field in both the Snappy (SnappyRawDecompressor.java) and LZ4 (Lz4RawDecompressor.java) Java decompressor implementations (CWE-125: Out-of-bounds Read; CWE-201: Insertion of Sensitive Information Into Sent Data). In LZ4, the check matchAddress < outputAddress failed to reject a zero offset (matchAddress >= output was not verified), allowing the decompressor to reference memory before the current output position — potentially pointing into stale buffer contents from a previous decompression call. In Snappy, the offset check used < 0 instead of <= 0, permitting a zero match offset that similarly reads pre-existing buffer data. The fix for LZ4 adds the condition matchAddress >= output to the bounds check, and the Snappy fix changes the comparison to <= 0 (LZ4 fix commit, Snappy fix commit). Exploitation requires that the application reuses the same output buffer across multiple decompression calls without clearing it between uses — a common pattern in high-performance servers (GitHub Advisory).

Successful exploitation allows a remote, unauthenticated attacker to extract sensitive data from a previous decompression operation by submitting a specially crafted compressed payload. The impact is limited to confidentiality — there is no integrity or availability impact. Applications most at risk are high-performance services (e.g., web servers, data processing pipelines) that allocate a fixed-size output buffer and reuse it across multiple decompression calls, as the leaked data reflects whatever was previously stored in that buffer, which could include credentials, session tokens, or other sensitive application data (GitHub Advisory, Github Advisory).

1. Identify a target: Locate a service that uses the Aircompressor library (versions < 2.0.3 or 3.0–3.3) to decompress Snappy or LZ4 data submitted by clients, and that reuses a fixed output buffer across multiple decompression calls (e.g., a high-performance Java web server or data API).
2. Craft a malicious compressed payload: Construct a compressed input with a zero match offset — for LZ4, craft a sequence where the match offset field resolves to zero (e.g., new byte[] {15, 0, 0, -1, -1, -118, 49, -1, -1, 0}); for Snappy, craft a back-reference with a zero offset (e.g., new byte[] {16, 1, 0, 1, 0, 1, 0, 1, 0}).
3. Submit the payload: Send the crafted compressed data to the target service's decompression endpoint, ensuring it is processed after a legitimate decompression operation has left sensitive data in the shared output buffer.
4. Receive leaked data: The decompressor, failing to reject the zero offset, copies pre-existing buffer contents into the decompressed output and returns it to the attacker, potentially exposing data from the prior decompression operation (LZ4 fix commit, Snappy fix commit, GitHub Advisory).

• Network: Repeated requests to decompression endpoints containing minimal or malformed compressed payloads (e.g., very short LZ4/Snappy frames with unusual match offset fields); responses from the server containing unexpected or garbled data that does not correspond to the submitted input.
• Logs: Application logs showing MalformedInputException errors referencing "offset outside destination buffer" (LZ4) or offset=2 (Snappy) from the Aircompressor library — these may indicate probing attempts against patched versions, or successful exploitation against unpatched ones.
• Application Behavior: Decompressed output returned to clients that contains data not present in the submitted compressed input, suggesting buffer content leakage from prior operations.

Upgrade to Aircompressor version 3.4 (for io.airlift:aircompressor-v3) or 2.0.3 (for io.airlift:aircompressor) to receive the fix (GitHub Advisory). If immediate patching is not possible, two workarounds can mitigate the risk: (1) avoid reusing the decompression output buffer across multiple calls, or (2) explicitly clear (zero-fill) the output buffer before each decompression call. IBM has also released patches for affected products including IBM Operational Decision Manager and IBM Db2 on Cloud Pak for Data (IBM ODM Advisory, IBM Db2 Advisory).

The advisory was published by the Aircompressor maintainer (martint) on December 12, 2025, with credited reporters and analysts (kyakdan, philippe-granet, lhotari) (Github Advisory). The vulnerability was noted as similar to a prior issue (GHSA-cmp6-m4wj-q63q), suggesting a pattern of buffer-reuse risks in Java compression libraries. Downstream vendors including IBM acknowledged the issue and issued their own security bulletins for affected products.