{"id":"CVE-2026-116590","kind":"vulnerability","aliases":["CVE-2026-116590"],"related":[],"title":"snappy-java: unchecked array copy lets crafted input read or write memory","description":"snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.","summary":"snappy-java's Snappy.arrayCopy and the stream read and write methods pass caller-supplied offsets and lengths straight to native memcpy without bounds checks. Out-of-range values can read or write outside Java arrays and crash the JVM.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","jvm","package","snappy-java"],"not_affected_if":["fixed-trusted-ranges"],"how_to_check":"- Find snappy-java in the build file or dependency tree, e.g. `mvn dependency:tree | grep snappy` or `gradle dependencies | grep snappy`\n- Check the resolved version; affected versions are those before `1.1.10.9`","fix":"- Upgrade org.xerial.snappy:snappy-java to `1.1.10.9` or later\n- Rebuild and redeploy services that bundle it","status":"open","published_at":"2026-10-26T22:16:55+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","triaged_at":"2026-10-26T22:28:00+00:00","updated_at":"2026-10-26T22:28:00+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:28:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade org.xerial.snappy:snappy-java to `1.1.10.9` or later\n- Rebuild and redeploy services that bundle it","reach":"unknown","title":"snappy-java: unchecked array copy lets crafted input read or write memory","impact":"medium","summary":"snappy-java's Snappy.arrayCopy and the stream read and write methods pass caller-supplied offsets and lengths straight to native memcpy without bounds checks. Out-of-range values can read or write outside Java arrays and crash the JVM.","category":"package","nicknames":[],"who_cares":["java","snappy-java","jvm"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes the JVM or corrupts memory outside array bounds","analyst_note":"","how_to_check":"- Find snappy-java in the build file or dependency tree, e.g. `mvn dependency:tree | grep snappy` or `gradle dependencies | grep snappy`\n- Check the resolved version; affected versions are those before `1.1.10.9`","needs_analyst":false,"not_affected_if":["fixed-trusted-ranges"],"who_is_affected":"Java applications that use snappy-java's arrayCopy or the SnappyInputStream and SnappyOutputStream read and write paths with ranges that can be influenced by outside input. Applications that only compress fixed internal data with trusted offsets are less exposed. The sources do not say which default paths reach the unchecked code.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3454,"output_tokens":553,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116590':16A,19A '-2026':15A,18A '1.1.10.9':87C,167C 'allow':111C 'array':5A,63B,110C,124C,137C,153C 'bound':50B,125C 'byte':155C 'byte-s':154C 'bytelength':94C,115C 'c':80C 'calcul':157C 'caller':40B,101C,144C 'caller-control':143C 'caller-suppli':39B,100C 'check':51B 'compresser/decompresser':81C 'control':145C 'copi':6A 'craft':8A 'crash':65B,127C 'cve':14A,17A 'dest':96C 'destoffset':98C 'develop':82C 'either':109C 'fast':79C 'fix':164C 'googl':84C 'includ':133C 'input':9A 'int':91C,93C,97C,160C 'issu':162C 'java':3A,20B,25B,28B,62B,70C,73C 'jvm':21B,67B,129C 'length':44B 'let':7A 'memcpi':48B,106C 'memori':13A 'method':37B,141C 'nativ':47B,105C 'negat':112C 'object':89C,95C 'offset':42B,92C,117C 'out-of-rang':52B 'outsid':61B,123C 'overflow':159C 'overs':114C 'packag':22B 'pass':38B,99C,142C 'port':74C 'primit':149C 'prior':85C 'rang':55B,103C,146C 'read':10A,34B,58B,120C,140C 'size':156C 'snappi':2A,24B,27B,69C,77C 'snappy-java':1A,23B,26B,68C 'snappy.arraycopy':30B,88C 'snappyinputstream.rawread':132C 'snappyoutputstream.rawwrite':130C 'src':90C 'straight':45B 'stream':33B 'suppli':41B,102C 'type':136C,152C 'typed-array':135C,151C 'uncheck':4A 'valid':108C 'valu':56B,118C 'version':166C 'without':49B,107C 'write':12A,36B,60B,122C,138C","nicknames":[],"mitigations":[],"who_affected":"Java applications that use snappy-java's arrayCopy or the SnappyInputStream and SnappyOutputStream read and write paths with ranges that can be influenced by outside input. Applications that only compress fixed internal data with trusted offsets are less exposed. The sources do not say which default paths reach the unchecked code.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116590","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116590","severity":null,"published_at":"2026-10-26T22:16:55+00:00","modified_at":"2026-10-26T22:16:55+00:00","first_seen_at":"2026-10-26T22:25:33+00:00","fetched_at":"2026-10-26T22:25:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}