CVE-2026-116590

MEDIUM 5.9

snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.

CWE	CWE-129 CWE-787
Vendor	xerial
Product	snappy-java
Published	Oct 26, 2026

Stay Ahead of the Next One

Get instant alerts for xerial snappy-java

Be the first to know when new medium vulnerabilities affecting xerial snappy-java are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

xerial / snappy-java

< 1.1.10.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7 github.com: https://github.com/xerial/snappy-java/pull/741 github.com: https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b github.com: https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9