CVE-2026-93451 snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods
Attackers can trigger a buffer overflow in snappy-java via crafted compressed input, leading to heap corruption and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-93451?
CVE-2026-93451 is a medium-severity memory corruption vulnerability in xerial snappy-java, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.
Weakness: CWE-787
Which versions are affected by CVE-2026-93451?
2 open source packages ship an affected version, including org.xerial.snappy:snappy-java.
| Package | Affected | Fixed in |
|---|---|---|
org.xerial.snappy:snappy-java Maven | All versions | 1.1.10.9 |
org.xerial.snappy:snappy-java Maven | All versions | 1.1.10.9 |
How do I fix CVE-2026-93451?
Upgrade org.xerial.snappy:snappy-java to 1.1.10.9 or later.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-93451 being exploited?
There is no known exploitation of CVE-2026-93451 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-MH58992, CLEANSTART-2026-OU24429, CLEANSTART-2026-WK92445, CLEANSTART-2026-XV24797, ECHO-9610-b82b-faac, GHSA-gwq9-9ffj-mvrv and 1 more.