CVE-2026-90559: snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
An attacker must be able to supply valid compressed data to an application that calls Snappy.uncompress(ByteBuffer, ByteBuffer) with a destination ByteBuffer that is smaller than the decompressed output. No authentication or user interaction is required according to the supplied vector.
What is the practical impact?
The out-of-bounds write can cause the JVM to terminate, resulting in a denial of service. The provided data does not indicate confidentiality or integrity impact.
Which deployments should be investigated first?
Investigate applications using snappy-java through 1.1.10.8 that decompress attacker-controlled or otherwise untrusted Snappy data through the ByteBuffer-to-ByteBuffer uncompress API. The supplied information does not establish whether other uncompress overloads are affected.
How can exposure be reduced before an update is available?
Ensure the destination ByteBuffer capacity is validated against the expected decompressed size before calling the affected API, and avoid passing untrusted compressed input to it where possible. The vulnerability exists because that capacity validation is not performed by the affected method.