Bug 2561447 (CVE-2026-116590)

Summary:	CVE-2026-116590 org.xerial.snappy/snappy-java: snappy-java: Denial of Service via out-of-bounds memory access
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, ant, aoconnor, asyoung, bniver, ccranfor, cescoffi, chfoley, cmah, dfreiber, dhanak, drosa, drow, dsimansk, ewittman, flucifre, fmariani, fmongiar, gmalinko, gmeno, groman, gsmet, gtanzill, janstey, jburrell, jbuscemi, jhollowa, jmartisk, jnethert, jpechane, jturenov, jwon, kaycoth, kingland, manderse, mbenjamin, mcarlett, mhackett, mnovotny, nipatil, olubyans, ozzy, pantinor, pdelbell, pjindal, prichard, rguimara, rhel-process-autobot, rkubis, rstepani, sausingh, sbiarozk, sostapov, sthirugn, swoodman, tcunning, varjain, vereddy, vkumar, watson-tool-maintainers, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in snappy-java. This vulnerability allows an attacker to cause a Denial of Service (DoS) by crashing the Java Virtual Machine (JVM). The issue occurs because memory copying routines fail to validate array bounds and buffer lengths before passing them to native memory operations. By supplying crafted or oversized input data, an attacker can trigger an out-of-bounds memory read or write, terminating the application unexpectedly.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-26 22:33:20 UTC

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.