Medium
snappy-java — security advisory
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
- Products
- snappy-java
- Affected versions
- 1.0.4.1~dfsg-1, 1.1.1.7-2, 1.1.10.5-1, 1.1.10.5-1build1, 1.1.10.7-1, 1.1.10.8-1, 1.1.2-1, 1.1.2.1-2, 1.1.4-1, 1.1.7.2-1, 1.1.7.3-1, 1.1.7.3-1build1, 1.1.8.3-1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-93451
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 03:32 UTC · Revision 1
Source evidence
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
osv:UBUNTU-CVE-2026-93451
snappy-java
Fixed versions: Not specified
snappy-java
Fixed versions: Not specified
snappy-java
Fixed versions: Not specified
snappy-java
Fixed versions: Not specified
snappy-java
Fixed versions: Not specified
snappy-java
Fixed versions: Not specified
snappy-java
Fixed versions: Not specified
snappy-java
Fixed versions: Not specified
Complete source record
{
"id": "e3f79cfaa6919e3d8e60bac20f523b436b2a6b76801ced6080e891f10244b419",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-93451",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-93451",
"summary": "snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.",
"evidence": "osv:UBUNTU-CVE-2026-93451",
"products": [
{
"name": {
"value": "snappy-java",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.0.4.1~dfsg-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "snappy-java",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.1.1.7-2",
"evidence": "/affected/1/versions"
},
{
"value": "1.1.2-1",
"evidence": "/affected/1/versions"
},
{
"value": "1.1.2.1-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "snappy-java",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.1.4-1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "snappy-java",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.1.7.2-1",
"evidence": "/affected/3/versions"
},
{
"value": "1.1.7.3-1",
"evidence": "/affected/3/versions"
},
{
"value": "1.1.7.3-1build1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "snappy-java",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.1.8.3-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "snappy-java",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.1.8.3-1",
"evidence": "/affected/5/versions"
},
{
"value": "1.1.10.5-1",
"evidence": "/affected/5/versions"
},
{
"value": "1.1.10.5-1build1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "snappy-java",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.1.10.8-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "snappy-java",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1.1.10.7-1",
"evidence": "/affected/7/versions"
},
{
"value": "1.1.10.8-1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-93451",
"aliases": [
"UBUNTU-CVE-2026-93451"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "snappy-java",
"purl": "pkg:deb/ubuntu/snappy-java?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"1.0.4.1~dfsg-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93451.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libsnappy-java",
"binary_version": "1.0.4.1~dfsg-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "snappy-java",
"purl": "pkg:deb/ubuntu/snappy-java?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"1.1.1.7-2",
"1.1.2-1",
"1.1.2.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93451.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libsnappy-java",
"binary_version": "1.1.2.1-2"
},
{
"binary_name": "libsnappy-jni",
"binary_version": "1.1.2.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "snappy-java",
"purl": "pkg:deb/ubuntu/snappy-java?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"1.1.4-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93451.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libsnappy-java",
"binary_version": "1.1.4-1"
},
{
"binary_name": "libsnappy-jni",
"binary_version": "1.1.4-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "snappy-java",
"purl": "pkg:deb/ubuntu/snappy-java?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"1.1.7.2-1",
"1.1.7.3-1",
"1.1.7.3-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93451.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libsnappy-java",
"binary_version": "1.1.7.3-1build1"
},
{
"binary_name": "libsnappy-jni",
"binary_version": "1.1.7.3-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "snappy-java",
"purl": "pkg:deb/ubuntu/snappy-java?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"1.1.8.3-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93451.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libsnappy-java",
"binary_version": "1.1.8.3-1"
},
{
"binary_name": "libsnappy-jni",
"binary_version": "1.1.8.3-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "snappy-java",
"purl": "pkg:deb/ubuntu/snappy-java?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"1.1.8.3-1",
"1.1.10.5-1",
"1.1.10.5-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93451.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libsnappy-java",
"binary_version": "1.1.10.5-1build1"
},
{
"binary_name": "libsnappy-jni",
"binary_version": "1.1.10.5-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "snappy-java",
"purl": "pkg:deb/ubuntu/snappy-java?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"1.1.10.8-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93451.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libsnappy-java",
"binary_version": "1.1.10.8-1"
},
{
"binary_name": "libsnappy-jni",
"binary_version": "1.1.10.8-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "snappy-java",
"purl": "pkg:deb/ubuntu/snappy-java?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"1.1.10.7-1",
"1.1.10.8-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-93451.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libsnappy-java",
"binary_version": "1.1.10.8-1"
},
{
"binary_name": "libsnappy-jni",
"binary_version": "1.1.10.8-1"
}
]
}
}
],
"modified": "2026-10-17T13:01:18.146698702Z",
"provider": "osv",
"upstream": [
"CVE-2026-93451"
],
"references": [
"https://ubuntu.com/security/CVE-2026-93451",
"https://www.cve.org/CVERecord?id=CVE-2026-93451",
"https://github.com/xerial/snappy-java",
"https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L802",
"https://github.com/xerial/snappy-java/issues/729",
"https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-buffer-overflow-via-typed-uncompress-methods"
]
},
"related_cves": [
{
"value": "CVE-2026-93451",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 361560,
"published_at": "2026-09-18T00:17:00+00:00"
}