Live › vulnerability › CVE-2026-116590
Go to dashboardsnappy-java's Snappy.arrayCopy and the stream read and write methods pass caller-supplied offsets and lengths straight to native memcpy without bounds checks. Out-of-range values can read or write outside Java arrays and crash the JVM.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Java applications that use snappy-java's arrayCopy or the SnappyInputStream and SnappyOutputStream read and write paths with ranges that can be influenced by outside input. Applications that only compress fixed internal data with trusted offsets are less exposed. The sources do not say which default paths reach the unchecked code.
No product ranges from the sources yet.
mvn dependency:tree | grep snappy or gradle dependencies | grep snappy1.1.10.91.1.10.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.
This page as .md · .json · in your agent: get_signal("CVE-2026-116590")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.