snappy-java unbounded memory allocation in decompression

Severity: high · CVSS 7.5 · Published 2026-10-09

snappy-java is a Java compression/decompression library used widely in applications to handle compressed data. An attacker can send a small amount of specially crafted compressed data that declares an extremely large uncompressed size, forcing the application to allocate gigabytes of memory and causing it to crash or become unavailable. This is a denial-of-service attack that requires no authentication or user interaction.

Technologies: org.xerial.snappy:snappy-java (Maven), Xerial Snappy-Java. Vendors: Maven, Xerial.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
High severity, with a CVSS score of 7.5, published 9 October 2026.
Which products and versions are affected?
org.xerial.snappy:snappy-java (Maven) < 1.1.10.9, ECOSYSTEM:introduced=0; Xerial Snappy-Java before 1.1.10.9.
Is there a fix for This vulnerability?
Yes: fixed in 1.1.10.9. Until then: Before decompressing untrusted data, check that Snappy.uncompressedLength(input) is within an application-specific limit to prevent excessive memory allocation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run org.xerial.snappy:snappy-java (Maven) or Xerial Snappy-Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.1.10.9

Before decompressing untrusted data, check that Snappy.uncompressedLength(input) is within an application-specific limit to prevent excessive memory allocation.

Technical details

The vulnerability is an unbounded memory allocation flaw (CWE-789) in snappy-java's decompression methods including Snappy.uncompress(), uncompressString(), SnappyInputStream, and SnappyFramedInputStream. These methods allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed stream, before validating that length. An attacker sending untrusted compressed data can declare a length up to 2 GB, forcing allocation and causing OutOfMemoryError or NegativeArraySizeException. The fix validates that declared lengths are proportional to actual input size (64/3 of compressed size at maximum density).

Affected products

  • Xerial snappy-java before 1.1.10.9

Timeline

  • 2026-10-03: disclosed: Initial advisory GHSA-q233-g92q-qxp6 published
  • 2026-10-03: patched: Version 1.1.10.9 released with fix
  • 2026-10-09: advisory: Duplicate advisory GHSA-94x4-5g3f-jjxp published
  • 2026-10-27: other: Duplicate advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.