CVE-2026-90559
snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 12, 2026
- Updated
- Oct 8, 2026
- Reserved
- Sep 12, 2026
Description
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
snappy-javaxerial |
|
References
- GitHub Issue #728issue-tracking
- https://github.com/xerial/snappy-javaproduct
- https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L561technical-description
- VulnCheck Advisory: snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompressthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.