CVE-2026-90559highCWE-787

CVE-2026-90559: fallo de gravedad alta en xerial snappy-java

snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear snappy-java

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.7epss 0.6%
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
xerial · snappy-java
CVEs relacionadas — xerial snappy-java

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-34455HIGHsnappy-java's unchecked chunk length leads to DoSEPSS 1.8%CVE-2023-34453MEDIUMsnappy-java's Integer Overflow vulnerability in shuffle leads to DoSEPSS 1.7%CVE-2023-34454MEDIUMsnappy-java's Integer Overflow vulnerability in compress leads to DoSEPSS 1.5%CVE-2023-43642HIGHMissing upper bound check on chunk length in snappy-java EPSS 1.2%CVE-2026-93452HIGHsnappy-java through 1.1.10.8 Buffer Overflow in Snappy.compressEPSS 0.7%CVE-2026-116590MEDIUMsnappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWriteEPSS 0.4%