Read the docs

xerial

Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

xerial records in CISA KEV

No xerial vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Records

11 records

Priority HIGH 77

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00681 Published 2026-09-17 Partial fix CWE-787
Priority HIGH 72

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01211 Published 2023-09-25 Partial fix · 1.1.10.4 CWE-770
Priority MEDIUM 45

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0063 Published 2026-09-12 Partial fix CWE-787
Priority MEDIUM 44

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00371 Published 2026-10-09 Partial fix · 1.1.10.9 CWE-789
TI-2026-62979 CVE-2026-93451 · GHSA-gwq9-9ffj-mvrv · GHSA-wm36-87w8-wg22

snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods

Priority LOW 36

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00296 Published 2026-09-17 Partial fix · 1.1.10.9 CWE-787
Priority LOW 27

Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00215 Published 2026-10-09 Partial fix · 1.1.10.10 CWE-415
Open these records in search →