GHSA-gwq9-9ffj-mvrv
snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.xerial.snappy:snappy-java | < 1.1.10.9 | 1.1.10.9 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
`Snappy.uncompressCharArray`, `uncompressShortArray`, `uncompressIntArray`, `uncompressLongArray`, `uncompressFloatArray` and `uncompressDoubleArray` sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap.
### Patches
Fixed in 1.1.10.9 ([#739](https://github.com/xerial/snappy-java/pull/739)). These methods now reject uncompressed lengths that are not a multiple of the element size with `SnappyIOException`.
### Workarounds
Check that `Snappy.uncompressedLength(input)` is a multiple of the element size before calling these methods.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/xerial/snappy-java/security/advisories/GHSA-gwq9-9ffj-mvrv
- https://nvd.nist.gov/vuln/detail/CVE-2026-93451
- https://github.com/xerial/snappy-java/issues/729
- https://github.com/xerial/snappy-java/pull/739
- https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75
- https://github.com/xerial/snappy-java
- https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802
- https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9
- https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods