GHSA-wm36-87w8-wg22Medium· 6.5▾ SunlitDuplicate Advisory: snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
This advisory has been withdrawn because it is a duplicate of GHSA-gwq9-9ffj-mvrv This link is maintained to preserve external references.
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
org.xerial.snappy:snappy-java <= 1.1.10.8Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93451Medium· 6.5snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code
CVE-2026-116590Medium· 5.9snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
GHSA-94x4-5g3f-jjxpHigh· 7.5Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha
CVE-2026-93452High· 7.5snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer
CVE-2026-90559High· 7.5snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size
CVE-2026-108104Medium· 4.8Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails