CVE-2026-93451: snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods

Awaiting analysis

AliasesUBUNTU-CVE-2026-93451GHSA-gwq9-9ffj-mvrvCGA-8h3c-mmxm-592m+399 more

Published 17-09-2026Last modified 08-10-2026

Vulnerability summary

CVE-2026-93451 is a medium (CVSS 6.9) Out-of-bounds Write vulnerability in xerial snappy-java. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 22.3% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.9/10

010

Medium · v4.0 (CVE.org)

EPSS score

0.30%

0%100%

Low · -0.21 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 1 · Downstream 0

GHSA-WM36-87W8-WG22

Timeline

17-09-2026
PublishedVulnerability first disclosed.
08-10-2026
Last modifiedVulnerability information updated.

Description

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.

CVSS metrics

9 scores · 6 sources · 2 versions

v4.06.9v3.16.5

EPSS trend

Probability

0.30%

Chance of exploitation in the next 30 days

Percentile

22%

Versus all other CVEs

30-day change

Decrease -0.21 pp

From 0.50% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard169 products

apache-hopAll versions (No fix recorded) | < 2.19.0-r9
apache-hop-fipsAll versions (No fix recorded) | < 2.19.0-r7
apache-nifi-2.11All versions (No fix recorded) | < 2.11.0-r15
apache-nifi-2.12All versions (No fix recorded) | < 2.12.0-r10
apache-polarisAll versions (No fix recorded) | < 1.8.0-r7

apache-polaris-fipsAll versions (No fix recorded) | < 1.8.0-r3
apicurio-registryAll versions (No fix recorded) | < 3.3.3-r10
apicurio-registry-fipsAll versions (No fix recorded) | < 3.3.3-r7
automqAll versions (No fix recorded) | < 1.7.4-r3
automq-fipsAll versions (No fix recorded) | < 1.7.4-r3
cassandra-4.0All versions (No fix recorded)
cassandra-4.1All versions (No fix recorded)
cassandra-5.0All versions (No fix recorded) | < 5.0.9-r15
cassandra-fips-4.0All versions (No fix recorded)
cassandra-fips-4.1All versions (No fix recorded)
cassandra-fips-5.0All versions (No fix recorded) | < 5.0.9-r2
celeborn-0.5All versions (No fix recorded)
celeborn-0.6All versions (No fix recorded)
celeborn-0.7All versions (No fix recorded)
commercial-elasticsearch-9.4All versions (No fix recorded) | < 9.4.9-r0
commercial-elasticsearch-9.5All versions (No fix recorded) | < 9.5.6-r0
conductorAll versions (No fix recorded) | < 3.33.0-r1
conductor-fips< 3.33.0-r1
cruise-control-fips-jarsAll versions (No fix recorded) | < 2.5.146-r11
cruise-control-jarsAll versions (No fix recorded) | < 2.5.146-r11
data-prepperAll versions (No fix recorded) | < 2.16.0-r4
datahub-frontendAll versions (No fix recorded) | < 1.8.0-r1
datahub-gmsAll versions (No fix recorded) | < 1.8.0-r1
datahub-gms-fipsAll versions (No fix recorded) | < 1.7.0.1-r5
debezium-3.5-connector-jdbcAll versions (No fix recorded) | < 3.5.2-r9
debezium-3.5-connector-mariadbAll versions (No fix recorded) | < 3.5.2-r9
debezium-3.5-connector-mongodbAll versions (No fix recorded)
debezium-3.5-connector-mysqlAll versions (No fix recorded) | < 3.5.2-r9
debezium-3.5-connector-postgresAll versions (No fix recorded) | < 3.5.2-r9
debezium-3.5-connector-sqlserverAll versions (No fix recorded) | < 3.5.2-r9
debezium-connector-db2-3.5All versions (No fix recorded) | < 3.5.2-r4
debezium-connector-ibmi-3.5All versions (No fix recorded) | < 3.5.2-r9
debezium-connector-informix-3.5All versions (No fix recorded) | < 3.5.2-r6
debezium-connector-spanner-3.3All versions (No fix recorded) | < 3.3.2-r12
debezium-connector-spanner-3.4< 3.4.3-r6
debezium-connector-spanner-3.5All versions (No fix recorded) | < 3.5.2-r8
debezium-connector-vitess-3.5All versions (No fix recorded) | < 3.5.2-r5
dependency-track-apiserver-5All versions (No fix recorded) | < 5.2.1-r1
druidAll versions (No fix recorded) | < 38.0.0-r7
elasticsearch-9.4All versions (No fix recorded) | < 9.4.8-r5
elasticsearch-9.4-iamguarded-fipsAll versions (No fix recorded) | < 9.4.8-r5
elasticsearch-9.5All versions (No fix recorded) | < 9.5.6-r0
elasticsearch-9.5-iamguarded-fipsAll versions (No fix recorded) | < 9.5.6-r0
elasticsearch-fips-9.4All versions (No fix recorded) | < 9.4.8-r5
elasticsearch-fips-9.5All versions (No fix recorded) | < 9.5.6-r0
flociAll versions (No fix recorded) | < 2.3.0-r3
hadoop-3.5All versions (No fix recorded) | < 3.5.0-r2
hadoop-fips-3.3.6All versions (No fix recorded)
hadoop-fips-3.4.2All versions (No fix recorded)
hadoop-fips-3.5All versions (No fix recorded) | < 3.5.0-r25
hono-adapter-mqttAll versions (No fix recorded) | < 2.7.0-r49
kafbat-uiAll versions (No fix recorded) | < 1.5.0-r20
kafbat-ui-fipsAll versions (No fix recorded) | < 1.5.0-r11
kafka-3.7All versions (No fix recorded) | < 3.7.2-r65
kafka-3.8All versions (No fix recorded) | < 3.8.1-r67
kafka-3.9All versions (No fix recorded) | < 3.9.2-r19
kafka-4.0All versions (No fix recorded) | < 4.0.2-r18
kafka-4.1All versions (No fix recorded) | < 4.1.2-r14
kafka-4.2All versions (No fix recorded) | < 4.2.2-r6
kafka-bridgeAll versions (No fix recorded)
kafka-bridge-fipsAll versions (No fix recorded) | < 1.2.1-r0
kafka-fips-4.1All versions (No fix recorded) | < 4.1.2-r16
kafka-fips-4.2< 4.2.2-r4
kafka-fips-4.3All versions (No fix recorded) | < 4.3.1-r12
kafka-for-strimzi-4.2.0All versions (No fix recorded)
kafka-for-strimzi-4.2.1All versions (No fix recorded)
kafka-for-strimzi-4.2.2All versions (No fix recorded)
kafka-for-strimzi-4.3.0All versions (No fix recorded)
kafka-for-strimzi-4.3.1All versions (No fix recorded)
kafka-for-strimzi-fips-4.2.0All versions (No fix recorded)
kafka-for-strimzi-fips-4.2.1All versions (No fix recorded)
kafka-for-strimzi-fips-4.2.2All versions (No fix recorded)
kafka-for-strimzi-fips-4.3.0All versions (No fix recorded)
kafka-for-strimzi-fips-4.3.1All versions (No fix recorded)
kafka-synth-clientAll versions (No fix recorded) | < 1.11.7-r3
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r25
knative-kafka-broker-1.20-receiver-loomAll versions (No fix recorded) | < 1.20.3-r25
knative-kafka-broker-1.21-dispatcher-loomAll versions (No fix recorded) | < 1.21.5-r10
knative-kafka-broker-1.21-receiver-loomAll versions (No fix recorded) | < 1.21.5-r10
knative-kafka-broker-1.22-dispatcher-loomAll versions (No fix recorded) | < 1.22.3-r24
knative-kafka-broker-1.22-receiver-loomAll versions (No fix recorded) | < 1.22.3-r24
knative-kafka-broker-1.23-dispatcher-loomAll versions (No fix recorded) | < 1.23.2-r6
knative-kafka-broker-1.23-receiver-loomAll versions (No fix recorded) | < 1.23.2-r6
knative-kafka-broker-fips-1.20-dispatcher-loomAll versions (No fix recorded) | < 1.20.3-r26
knative-kafka-broker-fips-1.20-receiver-loomAll versions (No fix recorded) | < 1.20.3-r26
knative-kafka-broker-fips-1.21-dispatcher-loomAll versions (No fix recorded) | < 1.21.5-r17
knative-kafka-broker-fips-1.21-receiver-loom< 1.21.5-r17
knative-kafka-broker-fips-1.22-dispatcher-loom< 1.22.3-r22
knative-kafka-broker-fips-1.22-receiver-loomAll versions (No fix recorded) | < 1.22.3-r22
knative-kafka-broker-fips-1.23-dispatcher-loomAll versions (No fix recorded) | < 1.23.2-r7
knative-kafka-broker-fips-1.23-receiver-loomAll versions (No fix recorded) | < 1.23.2-r7
logstash-8.19All versions (No fix recorded) | < 8.19.24-r0 | < 8.19.24-r1
logstash-8.19-iamguarded-compatAll versions (No fix recorded) | < 8.19.24-r0 | < 8.19.24-r1
logstash-8.19-with-output-opensearchAll versions (No fix recorded) | < 8.19.24-r0 | < 8.19.24-r1
logstash-9.2All versions (No fix recorded)
logstash-9.2-iamguarded-compatAll versions (No fix recorded)
logstash-9.2-with-output-opensearchAll versions (No fix recorded)
logstash-9.3All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded)
logstash-9.4All versions (No fix recorded) | < 9.4.8-r5
logstash-9.4-iamguarded-compatAll versions (No fix recorded) | < 9.4.8-r5
logstash-9.5All versions (No fix recorded) | < 9.5.6-r0 | < 9.5.6-r1
logstash-9.5-iamguarded-compatAll versions (No fix recorded) | < 9.5.6-r0 | < 9.5.6-r1
logstash-fips-9.4All versions (No fix recorded)
logstash-fips-9.4-iamguarded-compatAll versions (No fix recorded) | < 9.4.9-r0
logstash-fips-9.4-with-output-opensearchAll versions (No fix recorded) | < 9.4.9-r0
logstash-fips-9.5All versions (No fix recorded) | < 9.5.5-r2
logstash-fips-9.5-iamguarded-compatAll versions (No fix recorded) | < 9.5.5-r2
logstash-fips-9.5-with-output-opensearchAll versions (No fix recorded) | < 9.5.5-r2
neo4j-2026.04All versions (No fix recorded) | < 2026.04.0-r11
neo4j-2026.05All versions (No fix recorded) | < 2026.05.0-r18
neo4j-2026.06All versions (No fix recorded) | < 2026.06.0-r16
neo4j-2026.07All versions (No fix recorded) | < 2026.07.1-r9
neo4j-2026.08All versions (No fix recorded) | < 2026.08.1-r4
neo4j-2026.09All versions (No fix recorded) | < 2026.09.0-r3
neo4j-5.26All versions (No fix recorded) | < 5.26.32-r2
nuxeo-2023All versions (No fix recorded) | < 2023.45-r29
nuxeo-2025All versions (No fix recorded)
opensearch-2-securityAll versions (No fix recorded)
opensearch-3-securityAll versions (No fix recorded)
opensearch-fips-3-securityAll versions (No fix recorded)
rangerAll versions (No fix recorded) | < 2.9.0-r13
seata-serverAll versions (No fix recorded) | < 2.7.0-r20
solr-10All versions (No fix recorded) | < 10.0.0-r19
solr-10-iamguarded-compatAll versions (No fix recorded) | < 10.0.0-r19
solr-9All versions (No fix recorded) | < 9.11.0-r2
solr-9-iamguarded-compatAll versions (No fix recorded) | < 9.11.0-r2
solr-fips-10All versions (No fix recorded)
solr-fips-10-iamguarded-compatAll versions (No fix recorded)
solr-fips-9All versions (No fix recorded) | < 9.11.0-r1
solr-fips-9-iamguarded-compatAll versions (No fix recorded) | < 9.11.0-r1
spark-3.5-scala-2.12< 3.5.9-r10 | All versions (No fix recorded)
spark-3.5-scala-2.13All versions (No fix recorded)
spark-4.0-scala-2.13All versions (No fix recorded) | < 4.0.5-r1
spark-4.1-scala-2.13All versions (No fix recorded) | < 4.1.4-r2
spark-4.2-scala-2.13All versions (No fix recorded) | < 4.2.1-r2
spark-fips-3.5-scala-2.12All versions (No fix recorded) | < 3.5.8-r14
spark-fips-3.5-scala-2.13All versions (No fix recorded) | < 3.5.8-r14
spark-fips-4.1-scala-2.13All versions (No fix recorded) | < 4.1.2-r16
spark-fips-4.2-scala-2.13All versions (No fix recorded) | < 4.2.0-r19
strimzi-kafka-operator-cluster-operatorAll versions (No fix recorded) | < 1.3.0-r2
strimzi-kafka-operator-fips-cluster-operatorAll versions (No fix recorded)
strimzi-kafka-operator-fips-kafka-agentAll versions (No fix recorded)
strimzi-kafka-operator-fips-kafka-initAll versions (No fix recorded)
strimzi-kafka-operator-fips-topic-operatorAll versions (No fix recorded)
strimzi-kafka-operator-fips-tracing-agentAll versions (No fix recorded)
strimzi-kafka-operator-fips-user-operatorAll versions (No fix recorded)
strimzi-kafka-operator-kafka-agentAll versions (No fix recorded) | < 1.3.0-r2
strimzi-kafka-operator-kafka-initAll versions (No fix recorded) | < 1.3.0-r2
strimzi-kafka-operator-kafka-thirdparty-libs-ccAll versions (No fix recorded) | < 1.3.0-r2
strimzi-kafka-operator-topic-operatorAll versions (No fix recorded) | < 1.3.0-r2
strimzi-kafka-operator-tracing-agentAll versions (No fix recorded) | < 1.3.0-r2
strimzi-kafka-operator-user-operatorAll versions (No fix recorded) | < 1.3.0-r2
tezAll versions (No fix recorded) | < 0.10.5-r36
thingsboard-tb-mqtt-transportAll versions (No fix recorded) | < 4.4.0.1-r1
thingsboard-tb-nodeAll versions (No fix recorded) | < 4.4.0.1-r1
traccar< 6.16.0-r8
traccar-fipsAll versions (No fix recorded) | < 6.16.0-r8
wazuh-indexer-plugin-securityAll versions (No fix recorded)
zipkinAll versions (No fix recorded) | < 3.6.1-r33
zookeeper-3.8All versions (No fix recorded) | < 3.8.7-r5
zookeeper-3.9All versions (No fix recorded) | < 3.9.6-r6
zookeeper-fips-3.8All versions (No fix recorded) | < 3.8.7-r6
zookeeper-fips-3.9All versions (No fix recorded) | < 3.9.6-r6

Show all 169

Wolfi31 products

apicurio-registryAll versions (No fix recorded) | < 3.3.3-r10
cassandra-4.1All versions (No fix recorded)
cassandra-5.0All versions (No fix recorded) | < 5.0.9-r15
celeborn-0.6All versions (No fix recorded)
debezium-3.5-connector-jdbcAll versions (No fix recorded) | < 3.5.2-r9

Show all 31

2 vendors · 200 products · Showing 200 of 214

References

13 links

github.com/xerial/snappy-java/issues/729Issue TrackingREPORTWEB
github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.javaTechnical DescriptionREPORTWEBARTICLE
github.com/xerial/snappy-javaProductREPORTPACKAGE
www.vulncheck.com/advisories/…Third Party AdvisoryREPORTWEBAdvisory
ubuntu.com/security/CVE-2026-93451REPORT
www.cve.org/CVERecord?id=CVE-2026-93451REPORT
github.com/xerial/snappy-java/security/advisories/GHSA-gwq9-9ffj-mvrvWEB
nvd.nist.gov/vuln/detail/CVE-2026-93451Advisory
github.com/xerial/snappy-java/pull/739WEB
github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75WEB

Show all 13 references