CVE-2026-90559

snappy-java through 1.1.10.8 contains an out-of-bounds write (CWE-787) because Snappy.uncompress(ByteBuffer, ByteBuffer) never validates that the destination buffer's capacity can hold the decompressed output. An attacker who can supply compressed data to an application that calls this overload with a too-small destination buffer can send a valid Snappy stream that expands past the buffer's boundaries, causing out-of-bounds writes and terminating the JVM. The documented impact is denial of service — CVSS 4.0 rates it 8.7 (high) because it is remotely reachable with no privileges or user interaction and has high availability impact — although no confidentiality or integrity impact is documented. Any Java application embedding snappy-java up to and including 1.1.10.8 that decompresses untrusted input via this overload is affected, a pattern common in big-data middleware (e.g., Kafka, Spark, Hadoop, Cassandra) that links snappy-java as a dependency. No public proof of concept exists, the flaw is not on the CISA KEV, and no exploitation in the wild is known.

What to do: Upgrade snappy-java to the latest available release, since every version through 1.1.10.8 is vulnerable. If you cannot upgrade immediately, add a call-site check that the compressed stream's advertised uncompressed length does not exceed the destination buffer's capacity before invoking Snappy.uncompress(ByteBuffer, ByteBuffer), and reject oversized inputs. Audit services that accept Snappy-compressed payloads from untrusted clients — such as message brokers, RPC frameworks, and network decompression paths — as these represent the realistic attack surface.