GHSA-gwq9-9ffj-mvrv
Dashboard / Vulnerabilities / GHSA-gwq9-9ffj-mvrv
Summary: snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods
Details: ### Impact `Snappy.uncompressCharArray`, `uncompressShortArray`, `uncompressIntArray`, `uncompressLongArray`, `uncompressFloatArray` and `uncompressDoubleArray` sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap. ### Patches Fixed in 1.1.10.9 ([#739](https://github.com/xerial/snappy-java/pull/739)). These methods now reject uncompressed lengths that are not a multiple of the element size with `SnappyIOException`. ### Workarounds Check that `Snappy.uncompressedLength(input)` is a multiple of the element size before calling these methods.
References: https://github.com/xerial/snappy-java/security/advisories/GHSA-gwq9-9ffj-mvrv, https://nvd.nist.gov/vuln/detail/CVE-2026-93451, https://github.com/xerial/snappy-java/issues/729, https://github.com/xerial/snappy-java/pull/739, https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75, https://github.com/xerial/snappy-java, https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802, https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9, https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods
Affected packages
Package
Name: org.xerial.snappy:snappy-java
Purl: pkg:maven/org.xerial.snappy/snappy-java
Affected ranges
Type: ECOSYSTEM
Events:
