{"id":"GHSA-94x4-5g3f-jjxp","kind":"vulnerability","aliases":["GHSA-94x4-5g3f-jjxp"],"related":[],"title":"Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-q233-g92q-qxp6. This link is maintained to preserve external references.\n\n## Original Description\nXerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.","summary":"snappy-java before 1.1.10.9 trusts an uncompressed length declared inside compressed input and allocates up to 2 GB for it. A few crafted bytes passed to decompression calls can cause OutOfMemoryError and a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"org.xerial.snappy:snappy-java","fixed":[],"affected":"< 1.1.10.9","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-789","java","jvm","maven","package","snappy-java"],"not_affected_if":["no-untrusted-input"],"how_to_check":"- Check the snappy-java version in the project's build file or dependency tree, for example `mvn dependency:tree | grep snappy-java`\n- Look for calls to `Snappy.uncompress`, `Snappy.uncompressString`, `SnappyInputStream` or `SnappyFramedInputStream` that handle untrusted input","fix":"- Upgrade `org.xerial.snappy:snappy-java` to `1.1.10.9` or later, as the advisory's fixed version (the advisory itself is withdrawn as a duplicate of GHSA-q233-g92q-qxp6)","status":"withdrawn","published_at":"2026-10-09T15:31:33+00:00","first_seen_at":"2026-10-27T15:34:04+00:00","triaged_at":"2026-10-27T15:35:38+00:00","updated_at":"2026-10-27T15:35:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T15:35:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `org.xerial.snappy:snappy-java` to `1.1.10.9` or later, as the advisory's fixed version (the advisory itself is withdrawn as a duplicate of GHSA-q233-g92q-qxp6)","reach":"unknown","title":"snappy-java: crafted input forces huge allocation and JVM memory exhaustion","impact":"medium","summary":"snappy-java before 1.1.10.9 trusts an uncompressed length declared inside compressed input and allocates up to 2 GB for it. A few crafted bytes passed to decompression calls can cause OutOfMemoryError and a denial of service.","category":"package","nicknames":[],"who_cares":["java","jvm","maven","snappy-java"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker crashes the service by exhausting JVM memory","analyst_note":"Advisory is withdrawn as a duplicate; confirm the canonical record GHSA-q233-g92q-qxp6 for the fixed version, CVSS and exposure details.","how_to_check":"- Check the snappy-java version in the project's build file or dependency tree, for example `mvn dependency:tree | grep snappy-java`\n- Look for calls to `Snappy.uncompress`, `Snappy.uncompressString`, `SnappyInputStream` or `SnappyFramedInputStream` that handle untrusted input","needs_analyst":true,"not_affected_if":["no-untrusted-input"],"who_is_affected":"Any Java or JVM application that depends on snappy-java below 1.1.10.9 and decompresses data an outside party can supply, such as network payloads, uploads or message queue contents. Applications that only decompress data they produced themselves are much less exposed. Teams with no snappy-java dependency can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000683,"input_tokens":3502,"output_tokens":666,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-789':30B '1.1.10.9':42B,108C '2':55B,149C '5g3f':18A,23A '94x4':17A,22A 'advisori':2A,76C,78C 'alloc':8A,52B,113C,146C 'allow':116C 'attack':11A,117C,131C 'attacker-declar':10A 'byte':62B,137C 'call':66B 'caus':68B,151C 'compress':49B,129C 'contain':109C 'craft':61B,136C 'cwe':29B 'declar':12A,47B,123C 'decompress':65B 'denial':72B,154C 'descript':102C 'duplic':1A,75C,86C 'exhaust':119C 'extern':99C 'forc':145C 'g92q':91C 'gb':56B,150C 'ghsa':16A,21A,89C 'ghsa-94x4-5g3f-jjxp':15A,20A 'ghsa-q233-g92q-qxp6':88C 'input':50B,130C 'insid':48B 'java':5A,28A,31B,37B,40B,106C 'jjxp':19A,24A 'jvm':32B,120C 'larg':125C 'length':46B,127C 'lengtha':14A 'link':94C 'maintain':96C 'maven':33B 'memori':7A,112C,121C 'org.xerial.snappy':25A 'origin':101C 'outofmemoryerror':69B,152C 'packag':34B 'pass':63B 'preserv':98C 'q233':90C 'qxp6':92C 'refer':100C 'servic':74B,156C 'snappi':4A,36B,39B,105C 'snappy':27A 'snappy-java':3A,26A,35B,38B,104C 'snappy.uncompress':139C 'snappyframedinputstream':143C 'snappyinputstream':141C 'suppli':133C 'trust':43B 'unbound':6A,111C 'uncompress':13A,45B,126C 'uncompressstr':140C 'vulner':114C 'withdrawn':81C 'xerial':103C","nicknames":[],"mitigations":[],"who_affected":"Any Java or JVM application that depends on snappy-java below 1.1.10.9 and decompresses data an outside party can supply, such as network payloads, uploads or message queue contents. Applications that only decompress data they produced themselves are much less exposed. Teams with no snappy-java dependency can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T15:31:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-94x4-5g3f-jjxp","url":"https://github.com/advisories/GHSA-94x4-5g3f-jjxp","severity":"high","published_at":"2026-10-09T15:31:33+00:00","modified_at":"2026-10-27T15:33:19+00:00","first_seen_at":"2026-10-27T15:34:04+00:00","fetched_at":"2026-10-27T15:34:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}