Bug 2532603 (CVE-2026-90559)

Summary: CVE-2026-90559 org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds write
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: amctagga, ant, anujha, aoconnor, asoldano, asyoung, bbaranow, bmaxwell, bniver, bstansbe, ccranfor, cescoffi, cmah, dlofthou, ewittman, flucifre, fmariani, fmongiar, gmalinko, gmeno, groman, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jbuscemi, jhollowa, jmartisk, jnethert, jpechane, jwon, kaycoth, manderse, mbenjamin, mcarlett, mhackett, mosmerov, msvehla, nipatil, nwallace, olubyans, ozzy, pantinor, pberan, pdelbell, pesilva, pjindal, pmackay, prichard, rguimara, rhel-process-autobot, rkubis, rstancel, rstepani, sbiarozk, sostapov, sthirugn, tcunning, thjenkin, varjain, vdosoudi, vereddy, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in snappy-java. This out-of-bounds write vulnerability occurs in the `Snappy.uncompress` function when the destination buffer's capacity is not validated against the decompressed size. A remote attacker can supply valid compressed data that, when decompressed, exceeds the buffer's boundaries. This can lead to writes past buffer boundaries, resulting in a Denial of Service (DoS) by terminating the Java Virtual Machine (JVM).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2546709    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-12 18:11:17 UTC 
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.