Live › vulnerability › CVE-2026-93451
Go to dashboardSix Snappy.uncompress typed-array methods (char, short, int, long, float, double) size the output array by integer division, so a declared length that is not a multiple of the element size lets native code write up to 7 bytes past the end of the Java array. An attacker who supplies compressed input can corrupt heap memory in the calling process.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:34 UTC, 0h before NVD. All times on this page are UTC.
Applications that call the typed-array uncompress methods of snappy-java on data that can be influenced from outside, such as network payloads, uploaded files or messages from a queue. Code that only uses byte-array Snappy.uncompress, or that only compresses, is not on this path. Teams with no snappy-java dependency can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.xerial.snappy:snappy-java | maven | <= 1.1.10.8 | 1.1.10.9 |
mvn dependency:tree or inspect the build file for org.xerial.snappy:snappy-java and confirm the version is 1.1.10.8 or lower.uncompressCharArray, uncompressShortArray, uncompressIntArray, uncompressLongArray, uncompressFloatArray or uncompressDoubleArray in your code.org.xerial.snappy:snappy-java to 1.1.10.9.Snappy.uncompressedLength(input) is a multiple of the element size before calling these methods.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Snappy.uncompressCharArray, uncompressShortArray, uncompressIntArray, uncompressLongArray, uncompressFloatArray and uncompressDoubleArray sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap.
Fixed in 1.1.10.9 (#739). These methods now reject uncompressed lengths that are not a multiple of the element size with SnappyIOException.
Check that Snappy.uncompressedLength(input) is a multiple of the element size before calling these methods.
This page as .md · .json · in your agent: get_signal("CVE-2026-93451")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.