Veille CVE

Septembre 2026

3 CVE

Critique 0 Élevée 2 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « xerial snappy-java » ✕
  1. CVE-2026-93452 7.5 Élevée

    xerial snappy-java

    snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and causing JVM termination.

  2. CVE-2026-93451 6.5 Moyenne

    xerial snappy-java

    snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.

  3. CVE-2026-90559 7.5 Élevée

    xerial snappy-java

    snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.