CVE-2026-116590Medium· 5.9▾ Sunlitsnappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) called a native memcpy without validating the ranges. A negative or oversized byteLength or offset read or wrote outside the arrays and crashed the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, and therefore the typed-array write/read methods, pass caller-supplied ranges to this method.
Fixed in 1.1.10.9 (#741). Snappy.arrayCopy checks both ranges before copying. The stream read/write methods validate offsets and lengths, and reject typed-array ranges whose byte size overflows int.
Validate offsets and lengths before calling these methods.
org.xerial.snappy:snappy-java <= 1.1.10.8Upgrade to a patched release:
org.xerial.snappy:snappy-java 1.1.10.9Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93451Medium· 6.5snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code
GHSA-94x4-5g3f-jjxpHigh· 7.5Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha
GHSA-wm36-87w8-wg22Medium· 6.5Duplicate Advisory: snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods
CVE-2026-93452High· 7.5snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer
CVE-2026-90559High· 7.5snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size
CVE-2026-93862High· 7.2Fireware OS Out-of-Bounds Read in FireCluster Sync Allows Denial of Service