# org.xerial.snappy:snappy-java (Maven) vulnerabilities Source: https://junglewise.ai/threats/technologies/org-xerial-snappy-snappy-java Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/org-xerial-snappy-snappy-java.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 9 vulnerabilities in org.xerial.snappy:snappy-java (Maven): 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116590, was published on 26 October 2026. 1 vulnerability in the last four weeks, down 75% on the four before (4). ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 5 - All time: 9 (0 critical, 0 exploited in the wild) ## About org.xerial.snappy:snappy-java (Maven) Java library providing compression and decompression using the snappy algorithm. ## Latest org.xerial.snappy:snappy-java (Maven) vulnerabilities - [CVE-2026-116590: snappy-java buffer overflow in arrayCopy](https://junglewise.ai/threats/cve-2026-116590-snappy-java-is-a-java-port-of-the-snappy-a-fast-c-compresser) (medium, CVSS 5.9, published 26 Oct 2026) - [snappy-java unbounded memory allocation in decompression](https://junglewise.ai/threats/duplicate-advisory-snappy-java-unbounded-memory-allocation-from-ac3e5e8e) (high, CVSS 7.5, published 9 Oct 2026) - [CVE-2026-108106: Xerial snappy-java unbounded memory allocation](https://junglewise.ai/threats/cve-2026-108106-xerial-snappy-java-before-1-1-10-9-contains-an-unbounded-memory) (high, CVSS 7.5, published 9 Oct 2026) - [Duplicate Advisory: snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods](https://junglewise.ai/threats/duplicate-advisory-snappy-java-heap-buffer-overflow-in-snappy-3d5847b7) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-93451: snappy-java buffer overflow in Snappy.uncompress*Array](https://junglewise.ai/threats/cve-2026-93451-snappy-java-buffer-overflow-in-snappy-uncompress-array) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2023-43642: snappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact](https://junglewise.ai/threats/cve-2023-43642-snappy-java-s-missing-upper-bound-check-on-chunk-length-can-lead) (low, CVSS 3.1, published 25 Sep 2023) - [CVE-2023-34455: snappy-java's unchecked chunk length leads to DoS](https://junglewise.ai/threats/cve-2023-34455-snappy-java-s-unchecked-chunk-length-leads-to-dos) (low, CVSS 3.1, published 15 Jun 2023) - [CVE-2023-34454: snappy-java's Integer Overflow vulnerability in compress leads to DoS](https://junglewise.ai/threats/cve-2023-34454-snappy-java-s-integer-overflow-vulnerability-in-compress-leads-to) (low, CVSS 3.1, published 15 Jun 2023) - [CVE-2023-34453: snappy-java's Integer Overflow vulnerability in shuffle leads to DoS](https://junglewise.ai/threats/cve-2023-34453-snappy-java-s-integer-overflow-vulnerability-in-shuffle-leads-to) (low, CVSS 3.1, published 15 Jun 2023) ## Most severe org.xerial.snappy:snappy-java (Maven) vulnerabilities - [CVE-2026-108106: Xerial snappy-java unbounded memory allocation](https://junglewise.ai/threats/cve-2026-108106-xerial-snappy-java-before-1-1-10-9-contains-an-unbounded-memory) (high, CVSS 7.5, published 9 Oct 2026) - [CVE-2026-93451: snappy-java buffer overflow in Snappy.uncompress*Array](https://junglewise.ai/threats/cve-2026-93451-snappy-java-buffer-overflow-in-snappy-uncompress-array) (high, CVSS 7.5, published 18 Sep 2026) - [snappy-java unbounded memory allocation in decompression](https://junglewise.ai/threats/duplicate-advisory-snappy-java-unbounded-memory-allocation-from-ac3e5e8e) (high, CVSS 7.5, published 9 Oct 2026) - [Duplicate Advisory: snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods](https://junglewise.ai/threats/duplicate-advisory-snappy-java-heap-buffer-overflow-in-snappy-3d5847b7) (medium, CVSS 6.5, published 18 Sep 2026) - [CVE-2026-116590: snappy-java buffer overflow in arrayCopy](https://junglewise.ai/threats/cve-2026-116590-snappy-java-is-a-java-port-of-the-snappy-a-fast-c-compresser) (medium, CVSS 5.9, published 26 Oct 2026) - [CVE-2023-34455: snappy-java's unchecked chunk length leads to DoS](https://junglewise.ai/threats/cve-2023-34455-snappy-java-s-unchecked-chunk-length-leads-to-dos) (low, CVSS 3.1, published 15 Jun 2023) - [CVE-2023-34453: snappy-java's Integer Overflow vulnerability in shuffle leads to DoS](https://junglewise.ai/threats/cve-2023-34453-snappy-java-s-integer-overflow-vulnerability-in-shuffle-leads-to) (low, CVSS 3.1, published 15 Jun 2023) - [CVE-2023-34454: snappy-java's Integer Overflow vulnerability in compress leads to DoS](https://junglewise.ai/threats/cve-2023-34454-snappy-java-s-integer-overflow-vulnerability-in-compress-leads-to) (low, CVSS 3.1, published 15 Jun 2023) - [CVE-2023-43642: snappy-java's missing upper bound check on chunk length can lead to Denial of Service (DoS) impact](https://junglewise.ai/threats/cve-2023-43642-snappy-java-s-missing-upper-bound-check-on-chunk-length-can-lead) (low, CVSS 3.1, published 25 Sep 2023) ## Vulnerabilities per week 1 vulnerability in the last four weeks, down 75% on the four before (4). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 2 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Maven technologies - [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core): 259 vulnerabilities - [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat): 169 vulnerabilities - [com.liferay.portal:release.portal.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom): 159 vulnerabilities - [com.liferay.portal:release.dxp.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom): 125 vulnerabilities - [org.keycloak:keycloak-services (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services): 122 vulnerabilities - [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind): 86 vulnerabilities - [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core): 83 vulnerabilities - [org.apache.struts:struts2-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core): 60 vulnerabilities - [org.keycloak:keycloak-core (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core): 57 vulnerabilities - [org.xwiki.platform:xwiki-platform-oldcore (Maven)](https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore): 46 vulnerabilities - [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina): 44 vulnerabilities - [org.elasticsearch:elasticsearch (Maven)](https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch): 41 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "org.xerial.snappy:snappy-java (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-xerial-snappy-snappy-java, 9 November 2026.