RHLW-2026-df2f019d2581b594: Lightwell Security Advisory: aircompressor 0.27.0.rhlw-00003

Q: Which deployments are exposed to this issue?

Deployments using the io.airlift:aircompressor 0.27.0 artifact from Maven Central are the relevant population identified by the advisory. The issue affects the Java-based Snappy and LZ4 decompressor implementations.

Q: What should we do to remediate it?

Replace io.airlift:aircompressor 0.27.0 with Red Hat Lightwell's io.airlift:aircompressor 0.27.0.rhlw-00003 artifact. The advisory states that the patched artifact is a drop-in replacement.

Published Nov 5, 2026

Updated

Red Hat Lightwell has released io.airlift:aircompressor 0.27.0.rhlw-00003 with a backported security fix.

CVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer

This patched artifact is a drop-in replacement for io.airlift:aircompressor 0.27.0 from Maven Central.

Affected Software

1 affected componentFixes available

red-hat-lightwell/io.airlift:aircompressor>=0.27.0<0.27.0.rhlw-00003

0.27.0.rhlw-00003

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade red-hat-lightwell/io.airlift:aircompressor to a version that resolves this vulnerability.
Fixed in 0.27.0.rhlw-00003
Upgrade
Upgrade io.airlift:aircompressor to a version that resolves this vulnerability.
Fixed in 0.27.0.rhlw-00003

Event History

Nov 5, 2026

Advisory Published

via OSV·02:40 PM

Data Sourced

via OSV·02:40 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using the io.airlift:aircompressor 0.27.0 artifact from Maven Central are the relevant population identified by the advisory. The issue affects the Java-based Snappy and LZ4 decompressor implementations.

What should we do to remediate it?

Replace io.airlift:aircompressor 0.27.0 with Red Hat Lightwell's io.airlift:aircompressor 0.27.0.rhlw-00003 artifact. The advisory states that the patched artifact is a drop-in replacement.

RHLW-2026-df2f019d2581b594: Lightwell Security Advisory: aircompressor 0.27.0.rhlw-00003

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What should we do to remediate it?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What should we do to remediate it?