HIGH

CVE-2026-90559

2026-09-12 CVSS v3.1

CVSS

7.5

Description

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.

Weakness (CWE)

CWE-787 Out-of-bounds Write

EPSS Score

0.35%

Probability of exploitation in next 30 days

28.7th percentile

References

https://github.com/xerial/snappy-java https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L561 https://github.com/xerial/snappy-java/issues/728 https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-out-of-bounds-write-via-uncompress

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE