Out-of-Bounds Write Vulnerability in snappy-java by Xerial

CVE-2026-90559

What is CVE-2026-90559?

snappy-java versions prior to 1.1.10.8 are susceptible to an out-of-bounds write vulnerability in the Snappy.uncompress(ByteBuffer, ByteBuffer) method. This flaw arises because the capacity of the destination buffer is not validated against the size of the data being decompressed. As a result, attackers can craft valid compressed data that, when decompressed, exceeds the capacity of the destination buffer. Such exploitation can lead to writes beyond allocated buffer boundaries, risking potential JVM crashes and data corruption.

References