---
id: "CVE-2026-116590"
kind: "vulnerability"
aliases: ["CVE-2026-116590"]
title: "snappy-java: unchecked array copy lets crafted input read or write memory"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["java", "jvm", "package", "snappy-java"]
not_affected_if: ["fixed-trusted-ranges"]
published_at: "2026-10-26T22:16:55+00:00"
first_seen_at: "2026-10-26T22:25:33+00:00"
updated_at: "2026-10-26T22:28:00+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116590", "first_seen_at": "2026-10-26T22:25:33+00:00"}]
---

# snappy-java: unchecked array copy lets crafted input read or write memory

snappy-java's Snappy.arrayCopy and the stream read and write methods pass caller-supplied offsets and lengths straight to native memcpy without bounds checks. Out-of-range values can read or write outside Java arrays and crash the JVM.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find snappy-java in the build file or dependency tree, e.g. `mvn dependency:tree | grep snappy` or `gradle dependencies | grep snappy`
- Check the resolved version; affected versions are those before `1.1.10.9`

## Fix

- Upgrade org.xerial.snappy:snappy-java to `1.1.10.9` or later
- Rebuild and redeploy services that bundle it

## Timeline

- 2026-10-26T22:25:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116590

## From the sources

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_