~ / search / GHSA-gwq9-9ffj-mvrv

GHSA-gwq9-9ffj-mvrv

snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

Source: GitHub Advisory Database (reviewed) High CVE-2026-93451

Packages

EcosystemPackageAffectedFixed in
Maven org.xerial.snappy:snappy-java < 1.1.10.9 1.1.10.9

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact `Snappy.uncompressCharArray`, `uncompressShortArray`, `uncompressIntArray`, `uncompressLongArray`, `uncompressFloatArray` and `uncompressDoubleArray` sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap. ### Patches Fixed in 1.1.10.9 ([#739](https://github.com/xerial/snappy-java/pull/739)). These methods now reject uncompressed lengths that are not a multiple of the element size with `SnappyIOException`. ### Workarounds Check that `Snappy.uncompressedLength(input)` is a multiple of the element size before calling these methods.

References

External links from the advisory. They lead to third-party sites.