Description

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-12T18:16:44.743Z",
  "pubdate": "2026-09-12T18:16:44.743Z",
  "executiveSummary": "The snappy-java library, specifically versions up to and including 1.1.10.8, is susceptible to an out-of-bounds write vulnerability during the decompression process. This vulnerability resides in the Snappy.uncompress(ByteBuffer, ByteBuffer) function.\nThe flaw stems from a critical failure to validate the capacity of the destination ByteBuffer against the actual size of the decompressed data. An attacker can craft malicious, yet structurally valid, compressed payloads that result in a decompressed output exceeding the allocated destination buffer size.\nThe impact of this vulnerability is significant, potentially leading to memory corruption, unintended write operations beyond buffer boundaries, and resulting in an immediate JVM termination (Denial of Service).\nThis vulnerability is particularly dangerous because it does not require complex heap manipulation techniques; it relies on the library's internal failure to perform bounds checking. Successful exploitation requires an attacker to control the input data stream processed by the vulnerable uncompress method. Given the prevalence of snappy-java in data processing pipelines, this poses a risk to service availability and system stability.",
  "technicalDetails": "The core vulnerability is identified as an out-of-bounds write occurring within the native decompression routines triggered by Snappy.uncompress(ByteBuffer, ByteBuffer). In the snappy-java architecture, the library utilizes native JNI calls to perform high-performance compression and decompression operations. The vulnerability exists because the Java-side wrapper fails to perform a preliminary check or enforce a constraint that ensures the destination ByteBuffer is of sufficient capacity to house the entirety of the decompressed data stream.\nWhen Snappy.uncompress(ByteBuffer, ByteBuffer) is invoked, the library attempts to write the uncompressed payload directly into the provided ByteBuffer. If the decompressed size of the input data is greater than the remaining bytes available in the target ByteBuffer, the underlying native code continues the write operation. Because there is no check at the Java or native boundary to verify that 'decompressed_size <= destination_buffer_capacity', the memory write operation proceeds beyond the allocated heap or direct memory bounds.\nThe attack flow follows a predictable pattern: 1) An attacker identifies an application endpoint or data processing service that accepts compressed inputs via the snappy-java library. 2) The attacker crafts a malicious payload using the Snappy compression algorithm. This payload is engineered such that, while appearing as valid compressed data, its expansion factor results in an output size that exceeds the destination buffer allocated by the application for the uncompress operation. 3) The attacker submits this payload to the target system. 4) Upon invocation of the Snappy.uncompress method, the library begins writing the expanded data. 5) As the pointer advances past the end of the target buffer, it triggers an illegal memory access or an out-of-bounds write. 6) The operating system or the JVM memory management subsystem detects this invalid access, which typically results in a SIGSEGV or an immediate JVM crash, thereby causing a complete service denial.\nThis vulnerability impacts all versions of snappy-java up to 1.1.10.8. It does not necessarily require authentication if the processing pipeline is exposed to untrusted input. The technical severity is high due to the potential for arbitrary service disruption and the fundamental nature of the buffer management failure within a commonly used low-level utility library."
}