CVE-2026-93452

Overview

snappy-java 1.1.10.8 has a buffer overflow in Snappy.compress(ByteBuffer, ByteBuffer) that can corrupt off‑heap memory and crash the JVM. The flaw is triggered by incompressible data that exceeds the destination buffer’s remaining capacity. It can cause application downtime in any Java process using the affected library.

Description

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and causing JVM termination.

Impact

The vulnerability leads to off‑heap memory corruption and JVM termination, resulting in a denial‑of‑service (availability) for the affected application. While the description does not mention code execution, memory corruption could potentially affect integrity if exploited further. Defenders should treat this as a high‑risk issue that can disrupt services and may serve as a foothold for more advanced attacks.

Remediation

1. Upgrade snappy-java to version 1.1.10.9 or later where the buffer bounds check has been fixed. 2. If an upgrade is not immediately possible, restrict the size of data passed to Snappy.compress by validating input length against the destination buffer capacity. 3. Consider replacing snappy-java with an alternative compression library that performs bounds checking. 4. Monitor JVM crash logs and memory corruption indicators; enable JVM crash reporting and alerting for sudden terminations.

Risk context

The CVE is rated high with CVSS v3 of 7.5 and CVSS v4 of 8.7, indicating a serious threat. No EPSS data is available, but the severity suggests that organizations should prioritize patching or mitigation to avoid potential service outages.

Affected products

• snappy-java
• Apache Hadoop
• Apache Spark
• Apache Flink
• Confluent Kafka
• Google Cloud Dataflow
• Elastic Search
• Kafka Streams