HIGH 7.5 GitHub
CVE-2026-93451
snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods
### Impact
`Snappy.uncompressCharArray`, `uncompressShortArray`, `uncompressIntArray`, `uncompressLongArray`, `uncompressFloatArray` and `uncompressDoubleArray` sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap.
### Patches
Fixed in 1.1.10.9 ([#739](https://github.com/xe
Affected Products
- maven/org.xerial.snappy:snappy-java <= 1.1.10.8
References
- https://github.com/advisories/GHSA-gwq9-9ffj-mvrv
- https://github.com/xerial/snappy-java/security/advisories/GHSA-gwq9-9ffj-mvrv
- https://nvd.nist.gov/vuln/detail/CVE-2026-93451
- https://github.com/xerial/snappy-java/issues/729
This high severity vulnerability with a CVSS score of 7.5 was published on 2026-10-27 via GitHub. Affected: maven/org.xerial.snappy:snappy-java <= 1.1.10.8.
vulnfeed aggregates 15261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.