{"schema":"threatline.record/2","record":{"id":"GHSA-c73m-r934-8qvg","aliases":["GHSA-c73m-r934-8qvg"],"summary":"Double release of pooled buffers in SnappyFramedInputStream can share a buffer across streams","details":"### Impact\nWhen `SnappyFramedInputStream` needed larger buffers, it returned its current buffers to the buffer pool before allocating replacements. If the allocation failed (for example with `OutOfMemoryError` caused by a large declared chunk length), the stream still referenced the released buffers, and `close()` released them to the pool a second time. The default `CachingBufferPool` does not detect duplicates, so two later `SnappyFramedInputStream` instances could receive the same backing array, and one stream's decompressed data could be read or overwritten through another.\n\n### Patches\nFixed in 1.1.10.10 (#747). Buffer fields are cleared right after release, so a failed allocation can no longer lead to a second release.\n\n### Workarounds\nDiscard the buffer pool after an `OutOfMemoryError` during decompression, or pass a non-caching `BufferPool` to `SnappyFramedInputStream`.","categories":["Unclassified"],"product":"org.xerial.snappy:snappy-java","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/xerial/snappy-java/security/advisories/GHSA-c73m-r934-8qvg","source_modified_at":"2026-10-03T16:55:53Z","fetched_at":"2026-10-24T18:03:20.872036Z","package":{"ecosystem":"maven","name":"org.xerial.snappy:snappy-java"},"range":"<= 1.1.10.9"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/xerial/snappy-java/security/advisories/GHSA-c73m-r934-8qvg","source_modified_at":"2026-10-03T16:55:53Z","fetched_at":"2026-10-24T18:03:20.872036Z","package":{"ecosystem":"maven","name":"org.xerial.snappy:snappy-java"},"version":"1.1.10.10"}],"cvss":8.7,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-03T16:55:53Z","modified_at":"2026-10-03T16:55:53Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/xerial/snappy-java/security/advisories/GHSA-c73m-r934-8qvg","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-03T16:55:53Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-03T16:55:53Z","content_hash":"c3c78b2e6fd2adbccda982d90c4eadc824d2e59fffd184c9a9fe393c22d8ad02"}}