Live › vulnerability › GHSA-wm36-87w8-wg22
Go to dashboardsnappy-java through 1.1.10.8 passes an undivided length to native code in its typed Snappy.uncompress*Array methods, so attacker-controlled compressed input can write past array bounds. The result is heap memory corruption; this advisory is withdrawn as a duplicate of GHSA-gwq9-9ffj-mvrv.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:34 UTC. All times on this page are UTC.
Java services that decompress untrusted Snappy data into typed arrays with the snappy-java typed uncompress methods are exposed. Applications that only use the byte-array uncompress API, or never decompress data from outside their trust boundary, are less exposed. Teams should check the parent advisory GHSA-gwq9-9ffj-mvrv for the authoritative scope.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.xerial.snappy:snappy-java | maven | <= 1.1.10.8 | – |
mvn dependency:tree or check the build file for org.xerial.snappy:snappy-java at a version up to 1.1.10.8Snappy.uncompressFloatArray, Snappy.uncompressIntArray, Snappy.uncompressDoubleArray, Snappy.uncompressLongArray or Snappy.uncompressShortArrayorg.xerial.snappy:snappy-java past 1.1.10.8, using the fixed version named in GHSA-gwq9-9ffj-mvrvEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
This advisory has been withdrawn because it is a duplicate of GHSA-gwq9-9ffj-mvrv This link is maintained to preserve external references.
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
This page as .md · .json · in your agent: get_signal("GHSA-wm36-87w8-wg22")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.