{"schema":"threatline.record/2","record":{"id":"GHSA-q233-g92q-qxp6","aliases":["GHSA-q233-g92q-qxp6"],"summary":"Unbounded memory allocation from attacker-declared uncompressed length in snappy-java","details":"### Impact\nSeveral decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing `OutOfMemoryError` (denial of service), or a `NegativeArraySizeException` for declared lengths of 2^31 or more.\n\nAffected entry points include `Snappy.uncompress(byte[])`, `Snappy.uncompressString`, the `Snappy.uncompress*Array` methods, `SnappyInputStream`, and `SnappyFramedInputStream`. The `maxChunkSize` limit added for CVE-2023-43642 bounds only the compressed chunk length, so it does not prevent this.\n\n### Patches\nFixed in 1.1.10.9 (#739). `Snappy.uncompressedLength()` now rejects negative declared lengths, and lengths larger than any valid Snappy stream of the given size can produce. The densest Snappy element expands 3 bytes to 64, so the limit is 64/3 of the compressed size. Allocations are therefore proportional to the input actually received.\n\n### Workarounds\nBefore decompressing untrusted data, check that `Snappy.uncompressedLength(input)` is within an application-specific limit.","categories":["Unclassified"],"product":"org.xerial.snappy:snappy-java","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6","source_modified_at":"2026-10-03T16:55:49Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"ecosystem":"maven","name":"org.xerial.snappy:snappy-java"},"range":"<= 1.1.10.8"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6","source_modified_at":"2026-10-03T16:55:49Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"ecosystem":"maven","name":"org.xerial.snappy:snappy-java"},"version":"1.1.10.9"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-03T16:55:49Z","modified_at":"2026-10-03T16:55:49Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6","fetched_at":"2026-10-25T18:55:31.805249Z","source_modified_at":"2026-10-03T16:55:49Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-03T16:55:49Z","content_hash":"b2358b8833287037a4a0a0d6542fc4000b744ef885967867dbb9813a5f9a1569"}}