Executive brief
snappy-java is a Java library that compresses and decompresses data using the Snappy algorithm, commonly embedded in data processing applications. A buffer overflow vulnerability in versions through 1.1.10.8 allows attackers who control compressed input to write past array boundaries and corrupt heap memory, potentially leading to application crashes or data corruption.
Technical details
The vulnerability exists in the typed Snappy.uncompress*Array methods, which allocate output arrays by dividing the uncompressed length by element size but then pass the undivided length to native code. This mismatch causes a buffer overflow when decompressing attacker-controlled compressed data. The root cause is improper handling of array allocation size calculations in the Java-to-native boundary. An attacker can craft malicious compressed input to write attacker-controlled bytes past array bounds, corrupting heap memory. The vulnerability does not require authentication but requires the ability to control compressed input fed to the uncompress methods.
Affected products
- Xerial snappy-java through 1.1.10.8
Timeline
- 2026-09-18: disclosed