GHSA-gwq9-9ffj-mvrv

Suggest an improvement
Source
https://github.com/advisories/GHSA-gwq9-9ffj-mvrv
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-gwq9-9ffj-mvrv/GHSA-gwq9-9ffj-mvrv.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-gwq9-9ffj-mvrv
Aliases
Published
2026-10-27T15:33:42Z
Modified
2026-10-27T15:47:24Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods
Details

Impact

Snappy.uncompressCharArray, uncompressShortArray, uncompressIntArray, uncompressLongArray, uncompressFloatArray and uncompressDoubleArray sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap.

Patches

Fixed in 1.1.10.9 (#739). These methods now reject uncompressed lengths that are not a multiple of the element size with SnappyIOException.

Workarounds

Check that Snappy.uncompressedLength(input) is a multiple of the element size before calling these methods.

Database specific 
{
    "cwe_ids":  [
        "CWE-193",
        "CWE-787"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-27T15:33:42Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}
References

Affected packages

Maven / org.xerial.snappy:snappy-java

Package

Name
org.xerial.snappy:snappy-java
View open source insights on deps.dev
Purl
pkg:maven/org.xerial.snappy/snappy-java

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.1.10.9

Affected versions

1.*
1.0.1-rc1
1.0.1-rc2
1.0.1-rc3
1.0.1-rc4
1.0.3-rc1
1.0.3-rc2
1.0.3-rc3
1.0.3-rc4
1.0.3
1.0.3.1
1.0.3.2
1.0.3.3
1.0.4
1.0.4.1
1.0.5-M1
1.0.5-M2
1.0.5-M3
1.0.5-M4
1.0.5
1.0.5.1
1.0.5.2
1.0.5.3
1.0.5.4
1.1.0-M1
1.1.0-M2
1.1.0-M3
1.1.0-M4
1.1.0
1.1.0.1
1.1.1-M1
1.1.1-M2
1.1.1-M3
1.1.1-M4
1.1.1
1.1.1.1
1.1.1.2
1.1.1.3
1.1.1.4
1.1.1.5
1.1.1.6
1.1.1.7
1.1.2-M1
1.1.2-RC1
1.1.2-RC2
1.1.2-RC3
1.1.2
1.1.2.1
1.1.2.2
1.1.2.3
1.1.2.4
1.1.2.5
1.1.2.6
1.1.3-M1
1.1.3-M2
1.1.4-M1
1.1.4-M2
1.1.4-M3
1.1.4
1.1.7
1.1.7.1
1.1.7.2
1.1.7.3
1.1.7.4
1.1.7.5
1.1.7.6
1.1.7.7
1.1.7.8
1.1.8
1.1.8.1
1.1.8.2
1.1.8.3
1.1.8.4
1.1.9.0
1.1.9.1
1.1.10.0
1.1.10.1
1.1.10.2
1.1.10.3
1.1.10.4
1.1.10.5
1.1.10.6
1.1.10.7
1.1.10.8

Database specific

last_known_affected_version_range 
"<= 1.1.10.8"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-gwq9-9ffj-mvrv/GHSA-gwq9-9ffj-mvrv.json"