Multiple security vulnerabilities have been identified in snappy-java, a Java compression library, affecting versions through 1.1.10.8. The affected components include decompression entry points, stream classes, typed-array uncompress methods, and array-copy operations. Crafted compressed input or caller-supplied ranges can cause excessive memory allocation, out-of-bounds memory access, or heap corruption. The overall risk is denial of service and potential memory corruption in applications that process untrusted Snappy data.
CVE-2026-108106 (CVSS 7.5 — High): Several decompression paths allocate an output buffer based on the uncompressed length declared in the first bytes of compressed data before validation. A remote attacker can supply crafted compressed data to an application that decompresses it, causing an out-of-memory condition or denial of service.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in snappy-java, a Java compression library, affecting versions through 1.1.10.8. The affected components include decompression entry points, stream classes, typed-array uncompress methods, and array-copy operations. Crafted compressed input or caller-supplied ranges can cause excessive memory allocation, out-of-bounds memory access, or heap corruption. The overall risk is denial of service and potential memory corruption in applications that process untrusted Snappy data.
CVE-2026-108106 (CVSS 7.5 — High): Several decompression paths allocate an output buffer based on the uncompressed length declared in the first bytes of compressed data before validation. A remote attacker can supply crafted compressed data to an application that decompresses it, causing an out-of-memory condition or denial of service.[emaillocker id="1283"]
CVE-2023-43642: A prior snappy-java vulnerability involved compressed chunk length handling. It is associated with chunk-size limits that do not constrain declared uncompressed lengths.
CVE-2026-116590 (CVSS 5.9 — Medium): An array-copy operation used by stream and typed-array methods passes caller-supplied offsets and lengths to native memory copy without validating ranges. An attacker who can influence those ranges can cause out-of-bounds memory access and crash the Java virtual machine.
CVE-2026-93451 (CVSS 7.5 — High): Typed-array decompression methods size the result array by dividing the declared uncompressed byte length by the element size, while native code writes the full byte length. If the declared length is not a multiple of the element size, a remote attacker can cause a heap buffer overflow of up to seven bytes.
These vulnerabilities collectively present a significant risk to applications that process untrusted compressed data, because they can lead to denial of service and memory corruption. Systems that expose decompression functionality to remote input or accept caller-controlled ranges are most at risk. Organizations should prioritize review of affected components.
We recommend you to update snappy-java to version 1.1.10.9.
The following reports contain further technical details:
[/emaillocker]