StackRadar

CVE-2025-67721

High

Advisory

Published 12 Dec 2025In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.005
43rd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
59
of 17,781 indexed, latest versions
Container images
68
deployed by those charts
Fix available
2 of 2
affected packages

aircompressor Snappy and LZ4 Java-based decompressor implementation can leak information from reused output buffer

Carried by container images the latest versions of 59 of 17,781 indexed charts deploy, on 68 images.

Affected packageAffected versionsFixed inImages
aircompressormaven0.3, 0.8, 0.9, 0.10+6 more2.0.368
aircompressor-v3maven3.23.42
OSV records
GHSA-vx9q-rhv9-3jvg

Charts affected

59 by stars
ChartLatestAffected imagesRadar Score
trinopresto-loadbalancer0.2.101 of 2See more

trino presto-loadbalancer 0.2.10

1 of the 2 container images this version deploys carry CVE-2025-67721.

Container imageDigestPackageFixed in
trinodb/trino:4796af989b0846d
aircompressor@2.0.2
2.0.3

Open the chart page →

2,264
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2025-67721.

Container imageDigestPackageFixed in
trinodb/trino:45038c6f24ab1a4
aircompressor@0.27
2.0.3

Open the chart page →

21,211
shenyushenyu0.6.31 of 2See more

shenyu shenyu 0.6.3

1 of the 2 container images this version deploys carry CVE-2025-67721.

Container imageDigestPackageFixed in
apache/shenyu-bootstrap:2.5.11bd5756f6273
aircompressor@0.20
2.0.3

Open the chart page →

8,804
stewardsoftwaremillVerified publisher0.1.121 of 1See more

steward softwaremill 0.1.12

1 of the 1 container images this version deploys carry CVE-2025-67721.

Container imageDigestPackageFixed in
fthomas/scala-steward:latest367afe974b7a
aircompressor@0.27
2.0.3

Open the chart page →

589
hazelcaststakaterVerified publisher1.0.21 of 1See more

hazelcast stakater 1.0.2

1 of the 1 container images this version deploys carry CVE-2025-67721.

Container imageDigestPackageFixed in
hazelcast/hazelcast:latestf086bf0ecb23
aircompressor@2.0.2
2.0.3

Open the chart page →

1,702
trinostatcan1.23.41 of 2See more

trino statcan 1.23.4

1 of the 2 container images this version deploys carry CVE-2025-67721.

Container imageDigestPackageFixed in
trinodb/trino:405ee80ab5eeab2
aircompressor@0.21
2.0.3

Open the chart page →

13,767
sn-consolestreamnative1.13.01 of 1See more

sn-console streamnative 1.13.0

1 of the 1 container images this version deploys carry CVE-2025-67721.

Container imageDigestPackageFixed in
streamnative/private-cloud-console:v2.3.27-all91e54375e154
aircompressor@0.27
2.0.3

Open the chart page →

1,827
drillwearefrank1.3.61 of 3See more

drill wearefrank 1.3.6

1 of the 3 container images this version deploys carry CVE-2025-67721.

Container imageDigestPackageFixed in
apache/drill:1.21.11f96558fd292
aircompressor@0.10
2.0.3

Open the chart page →

9,397
hazelcastwenerme5.10.21 of 2See more

hazelcast wenerme 5.10.2

1 of the 2 container images this version deploys carry CVE-2025-67721.

Container imageDigestPackageFixed in
hazelcast/hazelcast:5.5.05dd5d31c7a06
aircompressor@0.27
2.0.3

Open the chart page →

2,634

Container images carrying it

68 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
bde2020/hive:2.3.2-postgresql-metastore620267768985
aircompressor@0.3
2.0.3
4
airbyte/workload-launcher:2.2.0119be7bfb719
aircompressor@2.0.2
2.0.3
2
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
aircompressor@0.20
2.0.3
2
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
aircompressor@0.20
2.0.3
2
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
aircompressor@0.20
2.0.3
2
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
aircompressor@0.20
2.0.3
2
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
aircompressor@0.20
2.0.3
2
gradiant/hive:2.3.2-postgresql-metastoreaae4f8a21f8b
aircompressor@0.3
2.0.3
2
gradiant/spark:2.4.4-python-alpine97657d56e927
aircompressor@0.10
2.0.3
2
hazelcast/hazelcast:5.5.05dd5d31c7a06
aircompressor@0.27
2.0.3
2
5200710/hive:3.1.3-postgresql-metastoree34ab066d2ed
aircompressor@0.10
2.0.3
1
ahmetfurkandemir/iceberg-rest-fixture-postgresql:1.10.0142231a0b8b7
aircompressor@0.27
2.0.3
1
airbyte/bootloader:2.2.0f71cf4e185d5
aircompressor@2.0.2
2.0.3
1
airbyte/connector-rollout-worker:2.0.2-alpha-c905e75d42813fcc191
aircompressor@2.0.2
2.0.3
1
airbyte/cron:2.2.0d97b67a1346d
aircompressor@2.0.2
2.0.3
1
airbyte/server:2.2.070e125498a1c
aircompressor@2.0.2
2.0.3
1
airbyte/worker:2.2.08060b88b29c8
aircompressor@2.0.2
2.0.3
1
airbyte/workload-api-server:2.2.042093cff86e9
aircompressor@2.0.2
2.0.3
1
apache/drill:1.21.11f96558fd292
aircompressor@0.10
2.0.3
1
apache/druid:29.0.10cef139b6bf1
aircompressor@0.21
2.0.3
1
apachepinot/pinot:latest-jdk110018bb04ced7
aircompressor@0.10
2.0.3
1
apachepulsar/pulsar:3.1.016f9fdab3fa6
aircompressor@0.20
2.0.3
1
apachepulsar/pulsar:2.10.03b262ab7a7d9
aircompressor@0.20
2.0.3
1
apachepulsar/pulsar:2.6.14db6ff0b4045
aircompressor@0.16
2.0.3
1
apachepulsar/pulsar:3.0.79c9947de139d
aircompressor@0.27
2.0.3
1
apachepulsar/pulsar:2.9.0d056c89b7131
aircompressor@0.20
2.0.3
1
apachepulsar/pulsar:2.8.2d538416d5afe
aircompressor@0.20
2.0.3
1
apache/ranger:2.7.076c176e8a0e4
aircompressor@0.27
2.0.3
1
apache/shenyu-bootstrap:2.5.11bd5756f6273
aircompressor@0.20
2.0.3
1
bivas/presto:0.19605545994f806
aircompressor@0.9
2.0.3
1
cmosborn/metabase-arm64:0.50.286ec0a8878ad2
aircompressor@0.27
2.0.3
1
datappeal/hive-metastore:lateste38c085a3567
aircompressor@0.8
2.0.3
1
dbanda/livy:0.80ca125e68e53
aircompressor@0.10
2.0.3
1
dbanda/spark:2.4.6d0e6367876ae
aircompressor@0.10
2.0.3
1
deltaio/delta-sharing-server:0.2.08b75118187c5
aircompressor@0.10
2.0.3
1
dremio/dremio-oss:24.1.080ed2e3b7c43
aircompressor@0.10
2.0.3
1
duck1123/dinsro:latest9568c5961d5d
aircompressor@0.27
2.0.3
1
fimperato/sparkvid-api:1.0.5-RELEASE604012b77841
aircompressor@0.10
2.0.3
1
fthomas/scala-steward:latest367afe974b7a
aircompressor@0.27
2.0.3
1
geoservercloud/geoserver-cloud-rest:1.0-RC25dc0c93a1710
aircompressor@0.20
2.0.3
1
geoservercloud/geoserver-cloud-wcs:1.0-RC247ae1bdb4bcc
aircompressor@0.20
2.0.3
1
geoservercloud/geoserver-cloud-webui:1.0-RC228c3e5a8c5a3
aircompressor@0.20
2.0.3
1
geoservercloud/geoserver-cloud-wfs:1.0-RC28c70ee06d5ab
aircompressor@0.20
2.0.3
1
geoservercloud/geoserver-cloud-wms:1.0-RC242775ba6a4da
aircompressor@0.20
2.0.3
1
gridgain/gridgain9:9.1.1895018390077b
aircompressor@2.0.2
2.0.3
1
hazelcast/hazelcast:5.3.18fe26efde8e1
aircompressor@0.21
2.0.3
1
hazelcast/hazelcast:latestf086bf0ecb23
aircompressor@2.0.2
2.0.3
1
jingking/geonetwork-hnap:4.2.843e74ab234e1
aircompressor@0.20
2.0.3
1
library/storm:2.4.0bd5d420506d6
aircompressor@0.3
2.0.3
1
lightbend/spark-history-server:2.4.00bedf37f428a
aircompressor@0.10
2.0.3
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.