CVE-2026-93452

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.

The snappy-java library has a flaw related to unchecked chunk length that can lead to a critical error in versions prior to 1.1.10.1. The hasNextChunk function does not validate the chunkSize variable, which can result in a NegativeArraySizeException or OutOfMemoryError.

The snappy-java library has an issue with unchecked multiplications that may lead to integer overflow in versions prior to 1.1.10.1. The `compress(char[] input)` function does not check the length of the array, which can result in critical errors.

The snappy-java library has a vulnerability related to unchecked multiplications, which may lead to integer overflow in versions prior to 1.1.10.1. The `shuffle(int[] input)` function can cause a critical error when the array length is not properly checked.