High severity · published Sep 12, 2026
CVE-2026-90559
snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
snappy-java · xerial
through 1.1.10.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90559
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90559
issue-tracking
https://github.com/xerial/snappy-java/issues/728
product
https://github.com/xerial/snappy-java
technical-description
https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L561
third-party-advisory
https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-out-of-bounds-write-via-uncompress
More from snappy-java
7.5
CVE-2026-108106
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
7.5
CVE-2026-93452
snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compress
7.5
CVE-2023-43642
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google
7.5
CVE-2023-34455
snappy-java is a fast compressor/decompressor for Java
7.5
CVE-2023-34454
snappy-java is a fast compressor/decompressor for Java