CVE-2026-93451mediumCWE-787

CVE-2026-93451: falha de média gravidade em xerial snappy-java

snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar snappy-java+ Monitorar org.xerial.snappy:snappy-java

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
xerial · snappy-java
CVEs relacionadas — xerial snappy-java

No mesmo produto, das mais perigosas para as menos.

CVE-2023-34455HIGHsnappy-java's unchecked chunk length leads to DoSEPSS 1.8%CVE-2023-34453MEDIUMsnappy-java's Integer Overflow vulnerability in shuffle leads to DoSEPSS 1.7%CVE-2023-34454MEDIUMsnappy-java's Integer Overflow vulnerability in compress leads to DoSEPSS 1.5%CVE-2023-43642HIGHMissing upper bound check on chunk length in snappy-java EPSS 1.2%CVE-2026-93452HIGHsnappy-java through 1.1.10.8 Buffer Overflow in Snappy.compressEPSS 0.7%CVE-2026-90559HIGHsnappy-java through 1.1.10.8 Out-of-Bounds Write via uncompressEPSS 0.6%