CVE-2026-116590 snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116590?
CVE-2026-116590 is a medium-severity vulnerability in xerial snappy-java, published on 26 Oct 2026.
Official description
snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.
Which versions are affected by CVE-2026-116590?
2 open source packages ship an affected version, including org.xerial.snappy:snappy-java.
| Package | Affected | Fixed in |
|---|---|---|
org.xerial.snappy:snappy-java Maven | All versions | 1.1.10.9 |
org.xerial.snappy:snappy-java Maven | All versions | 1.1.10.9 |
How do I fix CVE-2026-116590?
Upgrade org.xerial.snappy:snappy-java to 1.1.10.9 or later.
Is CVE-2026-116590 being exploited?
There is no known exploitation of CVE-2026-116590 in the wild and no public exploit code.
Sources
Also known as ECHO-4010-d537-7ccd, GHSA-xqrx-qh46-34m7, UBUNTU-CVE-2026-116590.