Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
1.1.9.x	✅
< 1.1.8.x	❌

Reporting a Vulnerability

https://github.com/xerial/snappy-java/security/advisories

Uncontrolled recursion and eager chunk allocation in SnappyInputStream
GHSA-6gp7-6wmv-gxqw published Oct 3, 2026 by xerial

High
Double release of pooled buffers in SnappyFramedInputStream can share a buffer across streams
GHSA-c73m-r934-8qvg published Oct 3, 2026 by xerial

High
Heap buffer overflow in Snappy.uncompress*Array typed-array methods
GHSA-gwq9-9ffj-mvrv published Oct 3, 2026 by xerial

High
Out-of-bounds write in Snappy.uncompress(ByteBuffer, ByteBuffer)
GHSA-wmgv-28fv-894x published Oct 3, 2026 by xerial

High
JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
GHSA-xqrx-qh46-34m7 published Oct 3, 2026 by xerial

Moderate
Out-of-bounds read and write in Snappy.compress and rawCompress from unchecked offsets and output size
GHSA-38f5-hf66-x965 published Oct 3, 2026 by xerial

Moderate
Unbounded memory allocation from attacker-declared uncompressed length in snappy-java
GHSA-q233-g92q-qxp6 published Oct 3, 2026 by xerial

High
Missing upper bound check on chunk length in snappy-java can lead to Denial of Service (DoS) impact
GHSA-55g7-9cwv-5qfv published Sep 23, 2023 by xerial

High
Integer overflow in shuffle leads to DoS
GHSA-pqr6-cmr2-h8hf published Jun 14, 2023 by xerial

Moderate
Integer overflow in compress leads to DoS
GHSA-fjpj-2g6w-x25r published Jun 14, 2023 by xerial

Moderate

Learn more about advisories related to xerial/snappy-java in the GitHub Advisory Database