Out-of-bounds memory access in snappy-java crashes the JVM
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 13 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-129 and the CVSS impact.
Summary
snappy-java versions before 1.1.10.9 are affected. The Snappy.arrayCopy method passes caller-supplied offset and length values to native memcpy without validating the arrays, so negative or oversized values read or write outside array bounds (CWE-787). A remote attacker with no privileges and no user interaction can crash the JVM, although the attack is rated high complexity.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| xerial | snappy-java | before 1.1.10.9 | 1.1.10.9 | Patch available | CNA |
| — | org.xerial.snappy:snappy-java (Maven) | before 1.1.10.9 | 1.1.10.9 | Patch available | GHSA-xqrx-qh46-34m7 |
- snappy-java Vendorxerial Affected before 1.1.10.9 Fixed in 1.1.10.9 Patch available CNA
- org.xerial.snappy:snappy-java (Maven) Vendor— Affected before 1.1.10.9 Fixed in 1.1.10.9 Patch available GHSA-xqrx-qh46-34m7
Remediation
Upgrade org.xerial.snappy:snappy-java to version 1.1.10.9. Red Hat lists these products as affected without a fix: OpenShift Serverless, Red Hat Ceph Storage 7 and 8 (plan: none available), Red Hat Ceph Storage 9 and Red Hat Fuse 7 (plan: no fix planned), and other products.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA snappy-java (xerial) Fixed in 1.1.10.9
- Fix · GHSA-xqrx-qh46-34m7 org.xerial.snappy:snappy-java (Maven) Fixed in 1.1.10.9 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 8 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 9 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Offline Knowledge Portal | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-26 Threatist record created from CVE-2026-116590
- 2026-10-27 Alias added: GHSA-xqrx-qh46-34m7
- 2026-10-27 Priority changed: MEDIUM → LOW
- 2026-10-29 Affected versions changed · Red Hat
- 2026-10-29 CVSS score added · Red Hat
- 2026-10-30 Affected versions changed · Red Hat
- 2026-10-30 CISA SSVC decision points changed
References
Other 5
- https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7
- https://github.com/xerial/snappy-java/pull/741
- https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b
- https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9
- https://github.com/xerial/snappy-java
More xerial vulnerabilities
- TI-2026-62980 snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compress CVSS 4.0HIGH 8.7
- TI-2023-23368 Missing upper bound check on chunk length in snappy-java CVSS 3.1HIGH 7.5
- TI-2023-17281 snappy-java's unchecked chunk length leads to DoS CVSS 3.1HIGH 7.5
- TI-2023-17280 snappy-java's Integer Overflow vulnerability in compress leads to DoS CVSS 3.1HIGH 7.5
- TI-2023-17279 snappy-java's Integer Overflow vulnerability in shuffle leads to DoS CVSS 3.1HIGH 7.5
- TI-2023-15973 Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-116590 · CVE Program
- CVE-2026-116590 · NVD
- FIRST EPSS
- GHSA-xqrx-qh46-34m7 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-116590 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences