CVE-2026-90559 snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompress
Attackers can cause JVM termination by supplying compressed data that overflows the destination buffer during decompression in snappy-java.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90559?
CVE-2026-90559 is a high-severity memory corruption vulnerability in xerial snappy-java, published on 12 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.
Weakness: CWE-787
Which versions are affected by CVE-2026-90559?
How do I fix CVE-2026-90559?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-90559 being exploited?
There is no known exploitation of CVE-2026-90559 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-DF81862, CLEANSTART-2026-FZ14074, CLEANSTART-2026-GD87503, CLEANSTART-2026-VP40557, ECHO-49f5-2d75-9004, GHSA-mrhq-xxpp-qf7j.