RHLW-2026-3813366f0e43c8bd: Lightwell Security Advisory: aircompressor 0.21.0.rhlw-00007
Red Hat Lightwell has released io.airlift:aircompressor 0.21.0.rhlw-00007 with backported fixes for CVE-2024-36114 and CVE-2025-67721.
CVE-2024-36114: Decompressors can crash the JVM and leak memory content in Aircompressor
CVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
This patched artifact is a drop-in replacement for io.airlift:aircompressor 0.21.0 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/io.airlift:aircompressorto a version that resolves this vulnerability.Fixed in 0.21.0.rhlw-00007 - Upgrade
Upgrade
io.airlift:aircompressorto a version that resolves this vulnerability.Fixed in 0.21.0.rhlw-00007
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What attacker access is indicated by the severity vector?
The severity vector indicates network-based exploitation with low attack complexity, requiring no privileges and no user interaction. The listed impacts are low confidentiality impact, low integrity impact, and high availability impact.
What replacement is available for deployments using the Maven Central artifact?
Red Hat Lightwell provides io.airlift:aircompressor 0.21.0.rhlw-00007. It is described as a drop-in replacement for io.airlift:aircompressor 0.21.0 from Maven Central.