CVE-2026-90559

Name of the Vulnerable Software and Affected Versions snappy-java versions prior to 1.1.10.9

Description An out-of-bounds write occurs in the Snappy.uncompress(ByteBuffer, ByteBuffer) function because the destination buffer capacity is not validated against the decompressed size. An attacker can provide valid compressed data that, when decompressed, exceeds the destination buffer's capacity, leading to writes beyond buffer boundaries and the termination of the Java Virtual Machine (JVM).

Recommendations Update snappy-java to version 1.1.10.9 or later. As a temporary mitigation, restrict the use of the Snappy.uncompress(ByteBuffer, ByteBuffer) function.