CVE-2026-93451 · GHSA-gwq9-9ffj-mvrv
snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods
- Risk score
- 53/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 18 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write pas…
- Affected
- org.xerial.snappy:snappy-java (maven) <= 1.1.10.8
- Fix
- Upgrade org.xerial.snappy:snappy-java to 1.1.10.9 or later.
- Exploitation
- No known exploitation
Story map
At a glance
org.xerial.snappy:snappy-java: Amber, patch this week. Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStrea…
The flaws
- CVE-2026-93451: Snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods (CVSS 6.5 · EPSS 1%)
- CVE-2026-108106: Snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha (CVSS 7.5 · EPSS 0%)
- CVE-2026-116590: Snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite (CVSS 5.9)
The fix
Upgrade org.xerial.snappy:snappy-java: 1.1.10.9 or later on your release line
Who is exposed: org.xerial.snappy:snappy-java (maven) <= 1.1.10.8
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-193 (CWE-193). 11 other warnings in 30 days
Why it is Yellow
- CVSS 6.5 medium
- On your watchlist: Maven
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| org.xerial.snappy:snappy-java | maven | <= 1.1.10.8 | 1.1.10.9 |
References
- https://github.com/advisories/GHSA-gwq9-9ffj-mvrv
- https://github.com/xerial/snappy-java/security/advisories/GHSA-gwq9-9ffj-mvrv
- https://nvd.nist.gov/vuln/detail/CVE-2026-93451
- https://github.com/xerial/snappy-java/issues/729
- https://github.com/xerial/snappy-java/pull/739
- https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75
- https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802
- https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9
- https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods
- https://github.com/advisories/GHSA-gwq9-9ffj-mvrv
Original description
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
Last activity 27 Oct 2026. Patch Forecast updates every hour.