CVE-2026-93451: snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods
Impact Snappy.uncompressCharArray, uncompressShortArray, uncompressIntArray, uncompressLongArray, uncompressFloatArray and uncompressDoubleArray sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap.
Patches Fixed in 1.1.10.9 (#739). These methods now reject uncompressed lengths that are not a multiple of the element size with SnappyIOException.
Workarounds Check that Snappy.uncompressedLength(input) is a multiple of the element size before calling these methods.
Other sources
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.xerial.snappy:snappy-javato a version that resolves this vulnerability.Fixed in 1.1.10.9 - Upgrade
Upgrade
snappy-javato a version that resolves this vulnerability.Fixed in 1.1.10.9 - Compensating control
Check that Snappy.uncompressedLength(input) is a multiple of the element size before calling the typed Snappy.uncompress*Array methods.
Event History
Frequently Asked Questions
Which application paths are exposed to this issue?
Applications using snappy-java through 1.1.10.8 are exposed when they call typed Snappy.uncompress*Array methods on compressed data controlled by an attacker. The vulnerable behavior is in output-array allocation and the length passed to native code.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network attack access with low complexity, no privileges required, and no user interaction required.
What can successful exploitation affect?
Misaligned uncompressed-length values can cause native code to write attacker-controlled bytes beyond the allocated array bounds, corrupting heap memory. The reported impact includes integrity and availability effects, with no reported confidentiality impact.