RHLW-2026-5d649d9a9a6d6709: Lightwell Security Advisory: aircompressor 0.26.0.rhlw-00002
Published Nov 5, 2026
·Updated
Red Hat Lightwell has released io.airlift:aircompressor 0.26.0.rhlw-00002 with backported fixes for CVE-2024-36114 and CVE-2025-67721.
CVE-2024-36114: Decompressors can crash the JVM and leak memory content in Aircompressor
CVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer
This patched artifact is a drop-in replacement for io.airlift:aircompressor 0.26.0 from Maven Central.
Affected Software
1 affected componentFixes available
red-hat-lightwell/io.airlift:aircompressor<0.26.0.rhlw-00002
0.26.0.rhlw-00002
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/io.airlift:aircompressorto a version that resolves this vulnerability.Fixed in 0.26.0.rhlw-00002 - Upgrade
Upgrade
io.airlift:aircompressorto a version that resolves this vulnerability.Fixed in 0.26.0.rhlw-00002
Event History
Nov 5, 2026
Advisory Published
via OSV·02:39 PM
Data Sourced
via OSV·02:39 PM
DescriptionSeverityAffected Software
Child vulnerabilities
Contains the following vulnerabilities.