Bug 2538808 (CVE-2026-93451)

Summary: CVE-2026-93451 org.xerial/snappy-java: snappy-java: Buffer overflow via malformed compressed input
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, ant, anujha, aoconnor, asoldano, asyoung, bbaranow, bmaxwell, bniver, bstansbe, ccranfor, cescoffi, cmah, dlofthou, ewittman, flucifre, fmariani, fmongiar, gmalinko, gmeno, groman, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jbuscemi, jhollowa, jmartisk, jnethert, jpechane, jwon, kaycoth, manderse, mbenjamin, mcarlett, mhackett, mosmerov, msvehla, nipatil, nwallace, olubyans, ozzy, pantinor, pberan, pdelbell, pesilva, pjindal, pmackay, prichard, rguimara, rhel-process-autobot, rkubis, rstancel, rstepani, sbiarozk, sostapov, sthirugn, tcunning, thjenkin, varjain, vdosoudi, vereddy, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in snappy-java. A buffer overflow vulnerability exists in the `Snappy.uncompress*Array` methods. This flaw occurs because the methods incorrectly calculate the output array size, passing an undivided length to native code. A remote attacker, by providing specially crafted compressed input, could exploit this to write past array boundaries with controlled data, leading to heap memory corruption.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-09-22 20:43:34 UTC 
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.