Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-116590 · GHSA-xqrx-qh46-34m7

snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

Risk score
40/100
CVSS
5.9 v3.1
Published
26 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteL…
Affected
org.xerial.snappy:snappy-java (maven) <= 1.1.10.8
Fix
Upgrade org.xerial.snappy:snappy-java to 1.1.10.9 or later.
Exploitation
No known exploitation

Story map

Story map: org.xerial.snappy:snappy-javaTHE FLAWSTHE FIXCVE-2026-116590Snappy-java: JVM crash fromunchecked ranges inSnappy.arrayCopy and…CVSS 5.9CVE-2026-108106Snappy-java: Unboundedmemory allocation fromattacker-declared…CVSS 7.5 · EPSS 0%CVE-2026-93451Snappy-java: Heap bufferoverflow inSnappy.uncompress*Array…CVSS 6.5 · EPSS 1%Upgrade…1.1.10.9or later on your release lineWho is exposedorg.xerial.snappy:snappy-java(maven) <= 1.1.10.8AMBER · PATCH THIS WEEKorg.xerial.snappy:snappy-javaXerial snappy-java before 1.1.10.9contains an unbounded memoryallocation vulnerability thatallows attackers to exhaustJVM memory by declaring a largeuncompressed length incompressed input. Attackers…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-129 (CWE-129)32 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

org.xerial.snappy:snappy-java: Amber, patch this week. Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStrea…

The flaws

  • CVE-2026-116590: Snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite (CVSS 5.9)
  • CVE-2026-108106: Snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha (CVSS 7.5 · EPSS 0%)
  • CVE-2026-93451: Snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods (CVSS 6.5 · EPSS 1%)

The fix

Upgrade org.xerial.snappy:snappy-java: 1.1.10.9 or later on your release line

Who is exposed: org.xerial.snappy:snappy-java (maven) <= 1.1.10.8

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.9 medium
  • On your watchlist: Maven

Affected packages

PackageEcosystemVulnerableFixed in
org.xerial.snappy:snappy-javamaven<= 1.1.10.81.1.10.9

References

Original description

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.

Last activity 27 Oct 2026. Patch Forecast updates every hour.