iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 15 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dain | snappy | before 0.5 | 0.5 | Patch available | CNA |
| — | org.iq80.snappy:snappy (Maven) | before 0.5 | 0.5 | Patch available | GHSA-8wh2-6qhj-h7j9 |
- snappy Vendordain Affected before 0.5 Fixed in 0.5 Patch available CNA
- org.iq80.snappy:snappy (Maven) Vendor— Affected before 0.5 Fixed in 0.5 Patch available GHSA-8wh2-6qhj-h7j9
Remediation
- Fix · CNA snappy (dain) Fixed in 0.5
- Fix · GHSA-8wh2-6qhj-h7j9 org.iq80.snappy:snappy (Maven) Fixed in 0.5 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Clients 2 | Affected | No fix yet |
| Logging Subsystem for Red Hat OpenShift | Affected | No fix yet |
| Migration Toolkit for Applications 6 | Affected | No fix planned: Will not fix |
| Migration Toolkit for Runtimes | Affected | No fix planned: Will not fix |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Will not fix |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix planned: Will not fix |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of Debezium 2 | Affected | No fix yet |
| Red Hat build of OptaPlanner 8 | Affected | No fix planned: Will not fix |
| streams for Apache Kafka | Affected | No fix planned: Will not fix |
Not affected: 12 products
- Cryostat 2
- OpenShift Serverless
- Red Hat AMQ Broker 7
- Red Hat AMQ Clients
- Red Hat Ansible Automation Platform 2
- Red Hat Build of Keycloak
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat build of Apache Camel 4 for Quarkus 3
- Red Hat build of Apache Camel for Spring Boot 4
- Red Hat build of Quarkus
Timeline
- 2026-10-02 Threatist record created from CVE-2024-36124
- 2026-10-03 Alias added: GHSA-8wh2-6qhj-h7j9
References
Sources
- CVE-2024-36124 · CVE Program
- CVE-2024-36124 · NVD
- FIRST EPSS
- GHSA-8wh2-6qhj-h7j9 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-36124 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences