Threats affecting pkg:maven/xerial/snappy-java

CVE-2026-116590 is a vulnerability in the xerial snappy-java library prior to version 1.1.10.9. It involves improper validation of array indices in the Snappy.arrayCopy method, which allows passing negative or oversized offset and byteLength values to native memcpy calls. This can cause out-of-bounds reads or writes, potentially crashing the Java Virtual Machine (JVM). The issue affects methods like SnappyOutputStream.rawWrite and SnappyInputStream.rawRead that use this primitive. The vulnerability is fixed in version 1.1.10.9.

CVE-2026-108106 is a high-severity vulnerability in xerial snappy-java before version 1.1.10.9. It involves unbounded memory allocation when processing compressed input with a large declared uncompressed length. Attackers can exploit this by supplying crafted bytes to various Snappy decompression functions, causing the JVM to allocate up to 2 GB of memory and potentially triggering an OutOfMemoryError, resulting in denial of service.

Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.

CVE-2026-93452 is a high-severity buffer overflow vulnerability in the snappy-java library up to version 1.1.10.8. The flaw occurs in the Snappy.compress(ByteBuffer, ByteBuffer) method, where an out-of-bounds write can happen if attackers supply incompressible data exceeding the destination buffer's capacity. This can corrupt off-heap memory and cause the Java Virtual Machine (JVM) to terminate unexpectedly.

snappy-java versions up to 1.1.10.8 have a buffer overflow vulnerability in the typed Snappy.uncompress*Array methods. This occurs due to a mismatch in how output arrays are allocated versus how native code receives length parameters, leading to potential out-of-bounds writes and heap memory corruption when processing crafted compressed input.

snappy-java versions up to 1.1.10.8 contain an out-of-bounds write vulnerability in the Snappy.uncompress(ByteBuffer, ByteBuffer) method. This occurs because the destination buffer's capacity is not validated against the decompressed size, allowing attackers to supply compressed data that decompresses to a size larger than the destination buffer. This can cause writes beyond buffer boundaries and lead to JVM termination.