Description
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| xerial | snappy-java | < 1.1.10.9 | 1.1.10.9 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | snappy-java | No fix yet | — |
| Debian 13 | snappy-java | No fix yet | — |
| Debian 12 | snappy-java | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | snappy-java | No fix yet | — |
| Ubuntu 26.04 LTS | snappy-java | No fix yet | — |
| Ubuntu 24.04 LTS | snappy-java | No fix yet | — |
| Ubuntu 22.04 LTS | snappy-java | No fix yet | — |
| Ubuntu 20.04 LTS | snappy-java | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | snappy-java | No fix yet | — |
| Ubuntu 16.04 LTS | snappy-java | No fix yet | — |
| Ubuntu 14.04 LTS | snappy-java | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apicurio-registry | 3.3.3-r10 | — |
| Wolfi rolling | cassandra-4.1 | 4.1.12-r6 | — |
| Wolfi rolling | cassandra-5.0 | 5.0.9-r15 | — |
| Wolfi rolling | celeborn-0.6 | 0.6.3-r20 | — |
| Wolfi rolling | debezium-3.5-connector-jdbc +6 | 3.5.2-r9 | — |
| Wolfi rolling | debezium-connector-db2-3.5 | 3.5.2-r4 | — |
| Wolfi rolling | debezium-connector-informix-3.5 | 3.5.2-r6 | — |
| Wolfi rolling | debezium-connector-spanner-3.5 | 3.5.2-r8 | — |
| Wolfi rolling | debezium-connector-vitess-3.5 | 3.5.2-r5 | — |
| Wolfi rolling | druid | 38.0.0-r7 | — |
| Wolfi rolling | kafka-4.1 | 4.1.2-r14 | — |
| Wolfi rolling | kafka-4.2 | 4.2.2-r6 | — |
| Wolfi rolling | logstash-9.3 +1 | No fix yet | — |
| Wolfi rolling | logstash-9.4 +1 | 9.4.8-r5 | — |
| Wolfi rolling | neo4j-2026.05 | 2026.05.0-r18 | — |
| Wolfi rolling | neo4j-2026.06 | 2026.06.0-r16 | — |
| Wolfi rolling | neo4j-2026.07 | 2026.07.1-r9 | — |
| Wolfi rolling | opensearch-3-security | 3.9.0-r7 | — |
| Wolfi rolling | solr-10 +1 | 10.0.0-r19 | — |
| Wolfi rolling | spark-4.0-scala-2.13 | 4.0.5-r2 | — |
| Wolfi rolling | spark-4.1-scala-2.13 | 4.1.4-r2 | — |
| Wolfi rolling | strimzi-kafka-operator-kafka-init +6 | 1.3.0-r2 | — |
| Wolfi rolling | tez | 0.10.5-r36 | — |
| Wolfi rolling | thingsboard-tb-node +1 | 4.4.0.1-r1 | — |
| Wolfi rolling | zipkin | 3.6.1-r33 | — |
| Wolfi rolling | zookeeper-3.9 | 3.9.6-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.xerial.snappy:snappy-java | < 1.1.10.9 | 1.1.10.9 | GHSA-q233-g92q-qxp6 |
References
- GitHub Security Advisory (GHSA-q233-g92q-qxp6) vendor-advisory
- Patch Commit patch
- snappy-java v1.1.10.9 Release Notes release-notes
- https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517 technical-description
- https://github.com/xerial/snappy-java product
- VulnCheck Advisory: Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service third-party-advisory