Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Vendor: xerial Clear all filters
TI-2026-70064 CVE-2026-108106 · GHSA-q233-g92q-qxp6

Xerial snappy-java allocates unbounded memory from crafted input

Priority MEDIUM 44

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00371 Published 2026-10-09 Partial fix · 1.1.10.9 CWE-789
TI-2026-70062 CVE-2026-108104

Double release of pooled buffers in Xerial snappy-java

Priority LOW 27

Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00215 Published 2026-10-09 Partial fix · 1.1.10.10 CWE-415
TI-2026-62980 CVE-2026-93452 · GHSA-pm27-vjq7-f5fv

snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compress

Priority HIGH 77

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00681 Published 2026-09-17 Partial fix CWE-787
TI-2026-62979 CVE-2026-93451 · GHSA-gwq9-9ffj-mvrv · GHSA-wm36-87w8-wg22

snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods

Priority LOW 36

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00296 Published 2026-09-17 Partial fix · 1.1.10.9 CWE-787
TI-2026-61573 CVE-2026-90559 · GHSA-mrhq-xxpp-qf7j

snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress

Priority MEDIUM 45

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.0063 Published 2026-09-12 Partial fix CWE-787
TI-2023-23368 CVE-2023-43642 · GHSA-55g7-9cwv-5qfv

Missing upper bound check on chunk length in snappy-java

Priority HIGH 72

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01211 Published 2023-09-25 Partial fix · 1.1.10.4 CWE-770