CVE-2026-93451: medium-severity vulnerability in xerial snappy-java
snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.3%
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
xerial · snappy-javaRelated CVEs — xerial snappy-java
In the same product, most dangerous first.
CVE-2023-34455HIGHsnappy-java's unchecked chunk length leads to DoSEPSS 1.8%CVE-2023-34453MEDIUMsnappy-java's Integer Overflow vulnerability in shuffle leads to DoSEPSS 1.7%CVE-2023-34454MEDIUMsnappy-java's Integer Overflow vulnerability in compress leads to DoSEPSS 1.5%CVE-2023-43642HIGHMissing upper bound check on chunk length in snappy-java EPSS 1.2%CVE-2026-93452HIGHsnappy-java through 1.1.10.8 Buffer Overflow in Snappy.compressEPSS 0.7%CVE-2026-90559HIGHsnappy-java through 1.1.10.8 Out-of-Bounds Write via uncompressEPSS 0.6%
References
https://github.com/xerial/snappy-javahttps://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802https://github.com/xerial/snappy-java/issues/729https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods