# snappy-java unbounded memory allocation in decompression

Source: https://junglewise.ai/threats/duplicate-advisory-snappy-java-unbounded-memory-allocation-from-ac3e5e8e  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-09. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-10-09

snappy-java is a Java compression/decompression library used widely in applications to handle compressed data. An attacker can send a small amount of specially crafted compressed data that declares an extremely large uncompressed size, forcing the application to allocate gigabytes of memory and causing it to crash or become unavailable. This is a denial-of-service attack that requires no authentication or user interaction.

Technologies: [org.xerial.snappy:snappy-java (Maven)](https://junglewise.ai/threats/technologies/org-xerial-snappy-snappy-java), [Xerial Snappy-Java](https://junglewise.ai/threats/technologies/snappy-java). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [Xerial](https://junglewise.ai/threats/vendors/xerial).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 9 October 2026.

**Which products and versions are affected?** org.xerial.snappy:snappy-java (Maven) < 1.1.10.9, ECOSYSTEM:introduced=0; Xerial Snappy-Java before 1.1.10.9.

**Is there a fix for This vulnerability?** Yes: fixed in 1.1.10.9. Until then: Before decompressing untrusted data, check that Snappy.uncompressedLength(input) is within an application-specific limit to prevent excessive memory allocation. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run org.xerial.snappy:snappy-java (Maven) or Xerial Snappy-Java at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.1.10.9

Before decompressing untrusted data, check that Snappy.uncompressedLength(input) is within an application-specific limit to prevent excessive memory allocation.

## Technical details

The vulnerability is an unbounded memory allocation flaw (CWE-789) in snappy-java's decompression methods including Snappy.uncompress(), uncompressString(), SnappyInputStream, and SnappyFramedInputStream. These methods allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed stream, before validating that length. An attacker sending untrusted compressed data can declare a length up to 2 GB, forcing allocation and causing OutOfMemoryError or NegativeArraySizeException. The fix validates that declared lengths are proportional to actual input size (64/3 of compressed size at maximum density).

## Affected products

- Xerial snappy-java before 1.1.10.9

## Timeline

- 2026-10-03: disclosed: Initial advisory GHSA-q233-g92q-qxp6 published
- 2026-10-03: patched: Version 1.1.10.9 released with fix
- 2026-10-09: advisory: Duplicate advisory GHSA-94x4-5g3f-jjxp published
- 2026-10-27: other: Duplicate advisory withdrawn

## References

- [https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6](https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6)

## Related threats

- [snappy-java buffer overflow in arrayCopy](https://junglewise.ai/threats/cve-2026-116590-snappy-java-is-a-java-port-of-the-snappy-a-fast-c-compresser)
- [Xerial snappy-java unbounded memory allocation](https://junglewise.ai/threats/cve-2026-108106-xerial-snappy-java-before-1-1-10-9-contains-an-unbounded-memory)
- [Xerial snappy-java double release vulnerability in SnappyFramedInputStream](https://junglewise.ai/threats/cve-2026-108104-xerial-snappy-java-from-1-1-7-4-before-1-1-10-10-contains-a)
- [Duplicate Advisory: snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods](https://junglewise.ai/threats/duplicate-advisory-snappy-java-heap-buffer-overflow-in-snappy-3d5847b7)
- [snappy-java buffer overflow in compress](https://junglewise.ai/threats/cve-2026-93452-snappy-java-buffer-overflow-in-compress)