Cloudanix VulnDB

CVE-2026-116590

Medium · 5.9

CVSS

5.9

EPSS

0.4%

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A compression library used by many Java programs can be tricked into crashing the entire application, causing outages until the library is updated.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unvalidated caller-supplied offsets and lengths in Snappy.arrayCopy are passed directly to native memcpy, enabling out-of-bounds reads or writes that can crash the JVM; typed-array size calculations in SnappyInputStream and SnappyOutputStream can also overflow.

Why it matters to the business

Applications using snappy-java for compression may experience sudden JVM crashes leading to service outages; the issue was disclosed two days ago with no known public exploits yet, but any unpatched deployment remains at risk of availability loss.

How an attack unfolds

An attacker supplies a maliciously crafted compressed stream or direct API call with negative or excessively large offset/length values; these flow through rawRead/rawWrite into arrayCopy and native memcpy, corrupting memory or crashing the process.

How to fix it

Upgrade snappy-java to version 1.1.10.9 or later; rebuild and redeploy all dependent applications; verify no older versions remain in any classpath or container image.

How to confirm the fix worked

Confirm snappy-java version 1.1.10.9+ is present in all build artifacts and runtime classpaths; attempt to trigger the vulnerable arrayCopy paths with boundary test cases and verify the JVM no longer crashes.

Typical attack path

  1. Identify an application endpoint or library call that accepts or processes snappy-compressed data
  2. Craft input with invalid offset or length values that trigger arrayCopy
  3. Deliver the payload via network, file, or API to cause JVM crash

How to detect it

Review application and JVM crash logs for segmentation faults or fatal errors during snappy stream operations; search process listings and dependency manifests for snappy-java versions prior to 1.1.10.9.

What your security team should do

  • Immediately inventory all Java projects for snappy-java dependency and enforce upgrade to 1.1.10.9
  • Add dependency scanning to CI pipelines to block future vulnerable versions
  • Monitor application logs for unexpected JVM crashes coinciding with compressed-data processing

The record

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities