Snappy-java Out-of-Bounds Write in ByteBuffer Decompression

Executive Summary

CVE-2026-90559 is an out-of-bounds write vulnerability in snappy-java versions up to 1.1.10.8. The issue occurs in the Snappy.uncompress(ByteBuffer, ByteBuffer) method where the destination buffer's capacity is never validated against the decompressed data size. Attackers can provide compressed data that decompresses to a size larger than the destination buffer, causing writes past buffer boundaries and JVM termination.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses snappy-java versions up to 1.1.10.8. Run commands like 'find / -name "snappy-java*.jar" 2>/dev/null' to locate the library. If found, verify the version with 'java -jar snappy-java-*.jar 2>/dev/null | grep Version' or inspect the JAR manifest. Monitor JVM crashes with SIGSEGV errors during Snappy decompression operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause denial of service by crashing the JVM with a SIGSEGV error when processing attacker-supplied Snappy data. It may also lead to memory corruption or buffer overflows, potentially allowing arbitrary code execution in rare cases. Applications using affected snappy-java versions for compression or decompression are at risk.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update snappy-java to a patched version beyond 1.1.10.8. If updating is not possible, restrict input sources to trusted data or implement custom validation in the Snappy.uncompress method to check destination buffer capacity before decompression. Disable applications using vulnerable versions if updates are unavailable.

Useful 0 Not Useful 0