{"id":"CVE-2026-93451","title":"snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code","summary":"snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Atta…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","cwe":["CWE-787","CWE-131","CWE-193"],"vendor":"xerial","product":"snappy-java","affected":["snappy-java <= 1.1.10.8"],"published":"2026-09-18","updated":"2026-10-08","sourceUpdated":"2026-10-08T16:18:00.330","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93451","references":[{"url":"https://github.com/xerial/snappy-java","label":"disclosure@vulncheck.com"},{"url":"https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802","label":"disclosure@vulncheck.com"},{"url":"https://github.com/xerial/snappy-java/issues/729","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods","label":"disclosure@vulncheck.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93451.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-93451"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2538808"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-93451"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93451"},{"url":"https://github.com/xerial/snappy-java/security/advisories/GHSA-gwq9-9ffj-mvrv"},{"url":"https://github.com/xerial/snappy-java/pull/739"},{"url":"https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75"},{"url":"https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9"},{"url":"https://github.com/advisories/GHSA-gwq9-9ffj-mvrv"}],"tags":["nvd","cve.org","csaf","vex","red-hat","ghsa","maven"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-21T16:28:43.993959Z"},"epss":0.00503,"epssPercentile":0.42844,"ingestedAt":"2026-09-17T23:31:20.694Z","aliases":["GHSA-gwq9-9ffj-mvrv"],"ecosystem":"maven","patched":["org.xerial.snappy:snappy-java 1.1.10.9"],"scores":{"nvd":6.5,"ghsa":7.5},"slug":"CVE-2026-93451","body":"## Overview\n\nsnappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat build of Quarkus, Red Hat Ceph Storage 8, … · no fix planned: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, … · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93451.json)\n\n## Package advisory (CVE-2026-93451)\n\nAffected packages:\n\n- `org.xerial.snappy:snappy-java <= 1.1.10.8`\n\nPatched in:\n\n- `org.xerial.snappy:snappy-java 1.1.10.9`\n\nSource: https://github.com/advisories/GHSA-gwq9-9ffj-mvrv","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}