StackRadarChart IndexLive demo

CVE-2025-67721

High

Advisory

Published 12 Dec 2025In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.005; 43rd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 59; of 17,781 indexed, latest versions
Container images: 68; deployed by those charts
Fix available: 2 of 2; affected packages

aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer

Carried by container images the latest versions of 59 of 17,781 indexed charts deploy, on 68 images.

Affected package	Affected versions	Fixed in	Images
aircompressormaven	0.3, 0.8, 0.9, 0.10+6 more	2.0.3	68
aircompressor-v3maven	3.2	3.4	2

OSV records: GHSA-vx9q-rhv9-3jvg

Charts affected

59 by stars

Chart

Latest

Affected images

Radar Score

trinopresto-loadbalancer

1 of 2 See more

trino presto-loadbalancer 0.2.10

1 of the 2 container images this version deploys carry CVE-2025-67721.

Container image	Digest	Package	Fixed in
trinodb/trino :479	6af989b0846d	aircompressor@2.0.2	2.0.3

Open the chart page →

2,264

rada-platformrada-platform

1 of 7 See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-67721.

Container image	Digest	Package	Fixed in
trinodb/trino :450	38c6f24ab1a4	aircompressor@0.27	2.0.3

Open the chart page →

21,211

shenyushenyu

1 of 2 See more

shenyu shenyu 0.6.3

1 of the 2 container images this version deploys carry CVE-2025-67721.

Container image	Digest	Package	Fixed in
apache/shenyu-bootstrap :2.5.1	1bd5756f6273	aircompressor@0.20	2.0.3

Open the chart page →

8,804

stewardsoftwaremill

1 of 1 See more

steward softwaremill 0.1.12

1 of the 1 container images this version deploys carry CVE-2025-67721.

Container image	Digest	Package	Fixed in
fthomas/scala-steward :latest	367afe974b7a	aircompressor@0.27	2.0.3

Open the chart page →

589

hazelcaststakater

1 of 1 See more

hazelcast stakater 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-67721.

Container image	Digest	Package	Fixed in
hazelcast/hazelcast :latest	f086bf0ecb23	aircompressor@2.0.2	2.0.3

Open the chart page →

1,702

trinostatcan

1 of 2 See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2025-67721.

Container image	Digest	Package	Fixed in
trinodb/trino :405	ee80ab5eeab2	aircompressor@0.21	2.0.3

Open the chart page →

13,767

sn-consolestreamnative

1 of 1 See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2025-67721.

Container image	Digest	Package	Fixed in
streamnative/private-cloud-console :v2.3.27-all	91e54375e154	aircompressor@0.27	2.0.3

Open the chart page →

1,827

drillwearefrank

1 of 3 See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2025-67721.

Container image	Digest	Package	Fixed in
apache/drill :1.21.1	1f96558fd292	aircompressor@0.10	2.0.3

Open the chart page →

9,397

hazelcastwenerme

1 of 2 See more

hazelcast wenerme 5.10.2

1 of the 2 container images this version deploys carry CVE-2025-67721.

Container image	Digest	Package	Fixed in
hazelcast/hazelcast :5.5.0	5dd5d31c7a06	aircompressor@0.27	2.0.3

Open the chart page →

2,634

Container images carrying it

68 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
metabase/metabase :v0.53.4.1	7807bc5cad17	aircompressor@0.27	2.0.3	1
opensearchproject/data-prepper :2.8.0	57c25fa01d3c	aircompressor@0.26	2.0.3	1
resurfaceio/resurface :3.7.84	d5cda2f64109	aircompressor@2.0.2 aircompressor-v3@3.2	2.0.3 3.4	1
slamdev/apache-hive :2.3.9-2.10.1	b4b029c9b15f	aircompressor@0.8	2.0.3	1
sslhep/hive-metastore :3.1.3	9e80af083079	aircompressor@0.10	2.0.3	1
streamnative/private-cloud-console :v2.3.27-all	91e54375e154	aircompressor@0.27	2.0.3	1
trinodb/trino :450	38c6f24ab1a4	aircompressor@0.27	2.0.3	1
trinodb/trino :479	6af989b0846d	aircompressor@2.0.2	2.0.3	1
trinodb/trino :405	ee80ab5eeab2	aircompressor@0.21	2.0.3	1
vespaengine/vespa :8.526.15	69b160f58211	aircompressor@0.27	2.0.3	1
ghcr.io/appscode/inbox-server :MailetGroup	4a2824296412	aircompressor@0.20	2.0.3	1
ghcr.io/joffreybvn/k8s-geyser :0.0.2	47f36880072e	aircompressor@0.27	2.0.3	1
ghcr.io/kubeflow/spark-operator/controller :2.2.1	865ff4da5686	aircompressor@0.27	2.0.3	1
ghcr.io/melodyyangaws/hive-metastore :3.0.0	e949b0f733f0	aircompressor@0.8	2.0.3	1
ghcr.io/microboxlabs/miot-srv :latest	4ec11d229028	aircompressor@0.20	2.0.3	1
ghcr.io/microboxlabs/miot-srv :latest	5796553b41ae	aircompressor@0.20	2.0.3	1
public.ecr.aws/v0r6c2e2/hive-metastore :latest	794b3bff9510	aircompressor@0.10	2.0.3	1
public.ecr.aws/v0r6c2e2/trino :latest	c265156b00d1	aircompressor@2.0.2 aircompressor-v3@3.2	2.0.3 3.4	1