Skip to main content
Components
Vulnerabilities
Security Events
Pricing
MCP
API
Docs
Sign up
Login
Find vulnerabilities. Fix fast with AI.
Search components by package, version, or CVE to get started.
org.xerial.snappy/snappy-java 1.1.10.3 | V… | Sonatype Guide
Get full component data and automated fixes with Sonatype Guide.
Sign up for free
maven
org.xerial.snappy
snappy-java
1.1.10.3
snappy-java 1.1.10.3
org.xerial.snappy
Published
Jul 21, 2023
•
Policy
compliance
maven Registry
Developer Trust Score
Recommended Version:
x.y.z
Recommended upgrade that meets your policy.
Compare Versions
Overview
Overview
Versions
87
Versions
87
Vulnerabilities
12
Vulnerabilities
12
Dependencies
1
Dependencies
1
Severity
Critical
(0)
High
(9)
Medium
(3)
Low
(0)
CVSS Score
0.0
10.0
EPSS Score
0.0
1.0
Malware
KEV Status
Published
Filter
Sort: Published (Newest first)
7.5
CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
affected
Severity
High
Published
Oct 10, 2026
6.3
CVE-2026-108104
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.
affected
Severity
Medium
Published
Oct 10, 2026
7.5
sonatype-2026-008849
org.xerial.snappy:snappy-java - Off-by-one Error
affected
Severity
High
Published
Oct 4, 2026
7.5
sonatype-2026-008848
org.xerial.snappy:snappy-java - Uncontrolled Recursion
affected
Severity
High
Published
Oct 4, 2026
6.5
sonatype-2026-008847
org.xerial.snappy:snappy-java - Out-of-bounds Read
affected
Severity
Medium
Published
Oct 4, 2026
8.2
sonatype-2026-008846
Snappy-Java - Buffer overflow from missing bounds checks in native memcpy operations [CVE-2026-116590]
affected
Severity
High
Published
Oct 4, 2026
8.7
sonatype-2026-008845
org.xerial.snappy:snappy-java - Double Free
affected
Severity
High
Published
Oct 4, 2026
7.5
sonatype-2026-008844
org.xerial.snappy:snappy-java - Allocation of Resources Without Limits or Throttling
affected
Severity
High
Published
Oct 4, 2026
8.7
CVE-2026-93452
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and causing JVM termination.
affected
Severity
High
Published
Sep 22, 2026
6.9
CVE-2026-93451
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
affected
Severity
Medium
Published
Sep 21, 2026
8.7
CVE-2026-90559
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.
affected
Severity
High
Published
Sep 14, 2026
7.5
CVE-2023-43642
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.
affected
Severity
High
Published
Sep 27, 2023
