CVE-2026-90559— snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress
Quick assessment
Affected
xerial snappy-java
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
以下是对该漏洞描述的中文翻译： snappy-java 库（版本至 1.1.10.8 及之前）在 方法中存在越界写入漏洞。由于未对解压后的数据大小与目标缓冲区容量进行校验，攻击者可以构造有效的压缩数据，使其解压后的体积大于目标缓冲区的容量，从而导致写入操作超出缓冲区边界，进而引发 JVM 崩溃（进程终止）。
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| xerial | snappy-java | ≤ 1.1.10.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-90559
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress
Source: CVE Program / CVE List V5
Vulnerability Description
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xerial | snappy-java | 0 ~ 1.1.10.8 | - |
|
II. Public POCs for CVE-2026-90559
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-90559
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-90559 (1)
Proof of Concept for CVE-2026-90559 (1)
Other References for CVE-2026-90559 (1)
IV. Related Vulnerabilities
Same product: snappy-java
Same vendor: xerial
-
CVE-2023-43642
Missing upper bound check on chunk length in snappy-java -
CVE-2023-34455
snappy-java's unchecked chunk length leads to DoS -
CVE-2023-34454
snappy-java's Integer Overflow vulnerability in compress lea -
CVE-2023-34453
snappy-java's Integer Overflow vulnerability in shuffle lead -
CVE-2023-32697
Sqlite-jdbc vulnerable to remote code execution when JDBC ur
Same weakness: CWE-787
-
CVE-2026-89266
stb_vorbis through 1.22 heap buffer overflow via codebook mu -
CVE-2026-78547
Out-of-Bounds Write -
CVE-2026-88053
Tesseract: Heap out-of-bounds write in Classify::ReadIntTemp -
CVE-2026-88051
Tesseract: Heap out-of-bounds write in GenericVector<T>::rea -
CVE-2026-88050
Tesseract: Out-of-bounds write in UnicharCompress via unvali
V. Comments for CVE-2026-90559
No comments yet