CVE-2024-36114

creationtimestamp| type| source ---|---|--- 2026-09-09 10:00:06+00:00| seen| Telegram/SxvhEYkSfwY-06pFLtOx1--AsX0ArgUo9aHBHntliw8A 2026-09-10 00:00:44+00:00| published-proof-of-concept| Telegram/SxvhEYkSfwY-06pFLtOx1--AsX0ArgUo9aHBHntliw8A...

Security Bulletin:IBM Asset Data Dictionary Component uses aircompressor-0.21.jar which is vulnerable to CVE-2024-36114

Summary IBM Asset Data Dictionary Component uses aircompressor-0.21.jar which is vulnerable to CVE-2024-36114. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-36114 DESCRIPTION: airlift aircompressor could allow a local attacker...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +4246 more potentially affected by CVE-2024-36114 via io.airlift:aircompressor (>=0.3, <=0.26)

io.airlift:aircompressor MAVEN version =0.3, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2024-36114 Source advisory: GHSA-973X-65J7-XCF4...

CVE-2024-36114 vulnerabilities

Vulnerabilities for packages: trino, druid, apache-nifi...

CVE-2024-36114 vulnerabilities

Vulnerabilities for packages: apache-nifi, druid, spark, trino...

CVE-2024-36114 Decompressors can crash the JVM and leak memory content in Aircompressor

Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor LZ4, LZO, Snappy, Zstandard can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java proce...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1, <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1, <=0.25-rc3) +4246 more potentially affected by CVE-2024-36114 via io.airlift:aircompressor (>=0.3, <=0.26)

io.airlift:aircompressor MAVEN version =0.3, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =1.2.10 and more Source cves: CVE-2024-36114 Source advisory: MEND:CVE-2024-36114...

CVE-2024-36114 Decompressors can crash the JVM and leak memory content in Aircompressor

Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor LZ4, LZO, Snappy, Zstandard can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java proce...

CVE-2024-36114 Decompressors can crash the JVM and leak memory content in Aircompressor

Aircompressor is a library with ports of the Snappy, LZO, LZ4, and Zstandard compression algorithms to Java. All decompressor implementations of Aircompressor LZ4, LZO, Snappy, Zstandard can crash the JVM for certain input, and in some cases also leak the content of other memory of the Java proce...