Buffer Overflow Vulnerability in Snappy Java by Xerial

CVE-2026-116590

What is CVE-2026-116590?

The snappy-java library, a Java port of Google's snappy compression algorithm, has a buffer overflow vulnerability in its method for copying arrays. This issue allows caller-supplied arguments to be passed to native memory copy functions without appropriate validation, potentially leading to negative or excessively large values. These unvalidated ranges can overwrite memory areas beyond allocated bounds, potentially crashing the Java Virtual Machine (JVM). The vulnerability affects all versions up to 1.1.10.9 and can be mitigated by updating to the latest version.

References