MavenPackage

org.xerial.snappy:snappy-java

7 known vulnerabilities (3 high, 4 medium), with the versions each affects and the releases that fix them.

Latest release: 1.1.10.12 (Oct 10, 2026): no advisory affects it
Newest unaffected release: 1.1.10.12 (Oct 10, 2026), the latest release
Advisories: 7 · 3 high, 4 medium

Dependents: 392
Releases: 87 since 1.0.3 (Jul 11, 2011)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2026-116590
Affects 1.0.1-rc1 to 1.1.10.8 (1.1.10.9 is outside it)
CVE-2026-108106
Affects 1.0.1-rc1 to 1.1.10.8 (1.1.10.9 is outside it)
CVE-2026-93451
Affects 1.0.1-rc1 to 1.1.10.8 (1.1.10.9 is outside it)
CVE-2023-43642
Affects 1.0.1-rc1 to 1.1.10.3 (1.1.10.4 is outside it)
CVE-2023-34455
Affects 1.0.1-rc1 to 1.1.10.0 (1.1.10.1 is outside it)
CVE-2023-34454
Affects 1.0.1-rc1 to 1.1.10.0 (1.1.10.1 is outside it)
CVE-2023-34453
Affects 1.0.1-rc1 to 1.1.10.0 (1.1.10.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2026-116590Medium 5.9
snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite
Affected: fixed in 1.1.10.9.
Fixed in 1.1.10.9 (released Oct 3, 2026, 23 days before disclosure).
The latest release, 1.1.10.12, is not affected.
CVE-2026-108106High 8.7
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Affected: fixed in 1.1.10.9.
Fixed in 1.1.10.9 (released Oct 3, 2026, 6 days before disclosure).
The latest release, 1.1.10.12, is not affected.
CVE-2026-93451Medium 6.9
snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods
Affected: fixed in 1.1.10.9.
Fixed in 1.1.10.9 (released Oct 3, 2026, 16 days after disclosure).
The latest release, 1.1.10.12, is not affected.
CVE-2023-43642High 7.5
Missing upper bound check on chunk length in snappy-java
Affected: fixed in 1.1.10.4.
Fixed in 1.1.10.4 (released Sep 23, 2023, 2 days before disclosure).
The latest release, 1.1.10.12, is not affected.
CVE-2023-34455High 7.5
snappy-java's unchecked chunk length leads to DoS
Affected: fixed in 1.1.10.1.
Fixed in 1.1.10.1 (released Jun 14, 2023, 1 day before disclosure).
The latest release, 1.1.10.12, is not affected.
CVE-2023-34454Medium 5.9
snappy-java's Integer Overflow vulnerability in compress leads to DoS
Affected: fixed in 1.1.10.1.
Fixed in 1.1.10.1 (released Jun 14, 2023, 1 day before disclosure).
The latest release, 1.1.10.12, is not affected.
CVE-2023-34453Medium 5.9
snappy-java's Integer Overflow vulnerability in shuffle leads to DoS
Affected: fixed in 1.1.10.1.
Fixed in 1.1.10.1 (released Jun 14, 2023, 1 day before disclosure).
The latest release, 1.1.10.12, is not affected.