snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

TRUNG BÌNH 6.5CVE-2026-93451 · GHSA-gwq9-9ffj-mvrv · Công bố 18/09/2026 · cập nhật 08/10/2026

Tóm tắt nhanh

CVE-2026-93451 là lỗ hổng mức TRUNG BÌNH (CVSS 6.5) ảnh hưởng org.xerial.snappy:snappy-java.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.30%, cao hơn 22.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.1.10.9 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.xerial.snappy:snappy-java Maven	`< 1.1.10.9`	`1.1.10.9`

Mô tả

Impact

Snappy.uncompressCharArray, uncompressShortArray, uncompressIntArray, uncompressLongArray, uncompressFloatArray and uncompressDoubleArray sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap.

Patches

Fixed in 1.1.10.9 (#739). These methods now reject uncompressed lengths that are not a multiple of the element size with SnappyIOException.

Workarounds

Check that Snappy.uncompressedLength(input) is a multiple of the element size before calling these methods.

Mô tả của NVD

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.