RHLW-2026-df2f019d2581b594

See a problem?
Please try reporting it to the source first.

Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-df2f019d2581b594.json

Import Source

https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-df2f019d2581b594.json

JSON Data

https://api.osv.dev/v1/vulns/RHLW-2026-df2f019d2581b594

Upstream

Published

2026-11-05T14:40:31Z

Modified

2026-11-06T19:30:03Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Lightwell Security Advisory: aircompressor 0.27.0.rhlw-00003

Details

Red Hat Lightwell has released io.airlift:aircompressor 0.27.0.rhlw-00003 with a backported security fix.

CVE-2025-67721: Aircompressor's Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer

This patched artifact is a drop-in replacement for io.airlift:aircompressor 0.27.0 from Maven Central.

References

Credits

- Red Hat Lightwell - REMEDIATION_DEVELOPER

Affected packages

Red Hat Lightwell:Maven / io.airlift:aircompressor

Package

Name: io.airlift:aircompressor
Purl: pkg:maven/io.airlift/aircompressor

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.27.0

Fixed

0.27.0.rhlw-00003

Affected versions

0.*

0.27

0.27.0

Database specific

lightwell

{
    "backport_base_version": "0.27.0",
    "remediated_version": "0.27.0.rhlw-00003",
    "repository_url": "https://packages.redhat.com/lightwell/java/remediated/"
}

source

"https://github.com/project-lightwell/lightwell-osv/blob/main/advisories/RHLW-2026-df2f019d2581b594.json"