---
id: CVE-2026-93451
title: >-
  snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed
  Snappy.uncompress*Array methods that allocate output arrays by dividing
  uncompressed length by element size but pass the undivided length to native
  code
summary: >-
  snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed
  Snappy.uncompress*Array methods that allocate output arrays by dividing
  uncompressed length by element size but pass the undivided length to native
  code. Atta…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
cwe:
  - CWE-787
  - CWE-131
  - CWE-193
vendor: xerial
product: snappy-java
affected:
  - snappy-java <= 1.1.10.8
published: '2026-09-18'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T16:18:00.330'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93451'
references:
  - url: 'https://github.com/xerial/snappy-java'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802
    label: disclosure@vulncheck.com
  - url: 'https://github.com/xerial/snappy-java/issues/729'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93451.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-93451'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2538808'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-93451'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93451'
  - url: >-
      https://github.com/xerial/snappy-java/security/advisories/GHSA-gwq9-9ffj-mvrv
  - url: 'https://github.com/xerial/snappy-java/pull/739'
  - url: >-
      https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75
  - url: 'https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9'
  - url: 'https://github.com/advisories/GHSA-gwq9-9ffj-mvrv'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - ghsa
  - maven
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T16:28:43.993959Z'
epss: 0.00503
epssPercentile: 0.42844
ingestedAt: '2026-09-17T23:31:20.694Z'
aliases:
  - GHSA-gwq9-9ffj-mvrv
ecosystem: maven
patched:
  - 'org.xerial.snappy:snappy-java 1.1.10.9'
scores:
  nvd: 6.5
  ghsa: 7.5
---

## Overview

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat build of Quarkus, Red Hat Ceph Storage 8, … · no fix planned: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, … · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-93451.json)

## Package advisory (CVE-2026-93451)

Affected packages:

- `org.xerial.snappy:snappy-java <= 1.1.10.8`

Patched in:

- `org.xerial.snappy:snappy-java 1.1.10.9`

Source: https://github.com/advisories/GHSA-gwq9-9ffj-mvrv