CVE-2026-95179: Airbnb lottie-android vulnerability
Published Oct 15, 2026
·Updated
An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.
Affected Software
1 affected component
Airbnb lottie-android<=6.7.1
Event History
Oct 15, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What input must an attacker control to trigger the denial of service?
The attacker must be able to supply or cause the application to load a crafted Lottie animation JSON. The JSON must contain a cyclic precomposition reference graph.
2
What is the impact of processing a malicious animation?
Processing the crafted animation can trigger uncontrolled recursion in BaseLayer.forModel and CompositionLayer, resulting in a denial of service.
3
Which releases are identified as affected?
lottie-android 6.7.1 and earlier are identified as affected. The master branch is also identified as affected.