Executive brief
snappy-java is a Java compression library used to reduce data size in applications. A buffer overflow vulnerability in the compression function allows attackers to supply data that crashes the Java runtime, causing service outages and potential data corruption.
Technical details
A buffer overflow exists in the Snappy.compress(ByteBuffer, ByteBuffer) method, where incompressible input data can exceed the destination buffer's remaining capacity, causing writes past the buffer boundary. This off-heap memory corruption can trigger JVM termination. The vulnerability affects snappy-java through version 1.1.10.8. The attack requires the ability to pass untrusted data to the compress method; no authentication or special privilege is required beyond application-level access to the API.
Affected products
- Xerial snappy-java through 1.1.10.8
Timeline
- 2026-09-18: disclosed