CVE-2026-95179 airbnb CVE debrief

Who should care

Defenders responsible for systems using lottie-android should assess exposure and prioritize verification and updates. This includes reviewing system configurations, validating Lottie animation inputs, and ensuring that lottie-android is updated to a fixed version if available. Additionally, defenders should monitor for potential denial-of-service attacks and review compensating controls for exposed systems.

Why it matters

CVE-2026-95179 is a denial-of-service vulnerability in lottie-android 6.7.1 and earlier. Defenders should assess exposure, prioritize verification and updates, and monitor for potential attacks.

• Denial-of-service attacks via crafted Lottie animation JSON
• Potential system crashes or instability

Technical summary

The vulnerability exists in lottie-android 6.7.1 and earlier. A crafted Lottie animation JSON can cause a denial of service by triggering uncontrolled recursion in BaseLayer.forModel and CompositionLayer. This issue is caused by a cyclic precomposition reference graph in the Lottie animation JSON. The affected product is lottie-android, and defenders should prioritize verifying and updating to a fixed version if available. The vulnerability can be triggered by a specific type of crafted Lottie animation JSON, which can cause a denial of service.

Defensive priority

Defenders should prioritize verifying and updating lottie-android to a fixed version, if available, and assess exposure in their systems.

Recommended defensive actions

• Verify lottie-android version and update to a fixed version if available
• Assess exposure in systems using lottie-android
• Monitor for potential denial-of-service attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, but affected versions and remediation require further verification from official sources. The vulnerability is caused by a cyclic precomposition reference graph in Lottie animation JSON, which triggers uncontrolled recursion. Evidence is limited to CVE and source item details; further verification is needed for specific versions and remediation. Defenders should verify lottie-android versions, assess exposure, and monitor for potential attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.