## snappy-java: Heap buffer overflow in Snappy.uncompress*Array typed-array methods

- 種別: advisory
- 重大度: high
- 関連技術: java
- CVE: CVE-2026-93451
- 公開日時: 2026-10-27T15:33:42.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-gwq9-9ffj-mvrv)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-gwq9-9ffj-mvrv

影響: maven:org.xerial.snappy:snappy-java <= 1.1.10.8 → 1.1.10.9
Snappy.uncompressCharArray, uncompressShortArray, uncompressIntArray, uncompressLongArray, uncompressFloatArray and uncompressDoubleArray sized the result array by dividing the declared uncompressed byte length by the element size, but native code wrote the full byte length. If the declared length is not a multiple of the element size, up to 7 bytes are written past the end of the Java array, corrupting the heap. Patches Fixed in 1.1.10.9 ([#739](https://github.com/xerial/snappy-java/pull/739))…