All vulnerabilities
CVE-2026-93451GHSA-gwq9-9ffj-mvrv

org.xerial.snappy:snappy-java: snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

xerial org.xerial.snappy:snappy-javamavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.50%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in1.1.10.9Fixed versionGitHub
Published17 Sep 2026Updated 27 Oct 2026CVE List

What fixes it

  • 1.1.10.9org.xerial.snappy:snappy-java, mavenGitHub<dependency><groupId>org.xerial.snappy</groupId><artifactId>snappy-java</artifactId><version>1.1.10.9</version></dependency>
  • 1.1.10.9org.xerial.snappy:snappy-java, MavenOSV<dependency><groupId>org.xerial.snappy</groupId><artifactId>snappy-java</artifactId><version>1.1.10.9</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Snappy.uncompressCharArray, uncompressShortArray, uncompressIntArray, uncompressLongArray, uncompressFloatArray and uncompressDoubleArray sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap.

Patches

Fixed in 1.1.10.9 (#739). These methods now reject uncompressed lengths that are not a multiple of the element size with SnappyIOException.

Workarounds

Check that Snappy.uncompressedLength(input) is a multiple of the element size before calling these methods.

Text from GitHub Advisory Database

Affected versions 53

  • org.xerial.snappy:snappy-java, maven<= 1.1.10.8GitHub
  • snappy-javaaffected: all versions through 1.1.10.8CVE List
  • org.xerial.snappy:snappy-java, Mavenfrom first release, fixed in 1.1.10.9OSV
  • org.xerial.snappy:snappy-java, Maven1.0.1-rc1OSV
  • org.xerial.snappy:snappy-java, Maven1.0.1-rc2OSV
  • org.xerial.snappy:snappy-java, Maven1.0.1-rc3OSV
  • org.xerial.snappy:snappy-java, Maven1.0.1-rc4OSV
  • org.xerial.snappy:snappy-java, Maven1.0.3OSV
  • org.xerial.snappy:snappy-java, Maven1.0.3-rc1OSV
  • org.xerial.snappy:snappy-java, Maven1.0.3-rc2OSV
  • org.xerial.snappy:snappy-java, Maven1.0.3-rc3OSV
  • org.xerial.snappy:snappy-java, Maven1.0.3-rc4OSV
  • org.xerial.snappy:snappy-java, Maven1.0.3.1OSV
  • org.xerial.snappy:snappy-java, Maven1.0.3.2OSV
  • org.xerial.snappy:snappy-java, Maven1.0.3.3OSV
  • org.xerial.snappy:snappy-java, Maven1.0.4OSV
  • org.xerial.snappy:snappy-java, Maven1.0.4.1OSV
  • org.xerial.snappy:snappy-java, Maven1.0.5OSV
  • org.xerial.snappy:snappy-java, Maven1.0.5-M1OSV
  • org.xerial.snappy:snappy-java, Maven1.0.5-M2OSV
  • org.xerial.snappy:snappy-java, Maven1.0.5-M3OSV
  • org.xerial.snappy:snappy-java, Maven1.0.5-M4OSV
  • org.xerial.snappy:snappy-java, Maven1.0.5.1OSV
  • org.xerial.snappy:snappy-java, Maven1.0.5.2OSV
  • org.xerial.snappy:snappy-java, Maven1.0.5.3OSV
  • org.xerial.snappy:snappy-java, Maven1.0.5.4OSV
  • org.xerial.snappy:snappy-java, Maven1.1.0OSV
  • org.xerial.snappy:snappy-java, Maven1.1.0-M1OSV
  • org.xerial.snappy:snappy-java, Maven1.1.0-M2OSV
  • org.xerial.snappy:snappy-java, Maven1.1.0-M3OSV
  • org.xerial.snappy:snappy-java, Maven1.1.0-M4OSV
  • org.xerial.snappy:snappy-java, Maven1.1.0.1OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1-M1OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1-M2OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1-M3OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1-M4OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1.1OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1.2OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1.3OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1.4OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1.5OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1.6OSV
  • org.xerial.snappy:snappy-java, Maven1.1.1.7OSV
  • org.xerial.snappy:snappy-java, Maven1.1.10.0OSV
  • org.xerial.snappy:snappy-java, Maven1.1.10.1OSV
  • org.xerial.snappy:snappy-java, Maven1.1.10.2OSV
  • org.xerial.snappy:snappy-java, Maven1.1.10.3OSV
  • org.xerial.snappy:snappy-java, Maven1.1.10.4OSV
  • org.xerial.snappy:snappy-java, Maven1.1.10.5OSV
  • org.xerial.snappy:snappy-java, Maven1.1.10.6OSV
  • org.xerial.snappy:snappy-java, Maven1.1.10.7OSV
  • org.xerial.snappy:snappy-java, Maven1.1.10.8OSV

References 10