# org.xerial.snappy:snappy-java (Maven) vulnerabilities 7 known vulnerabilities (3 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.1.10.12 (Oct 10, 2026): no advisory affects it - Newest unaffected release: 1.1.10.12 (Oct 10, 2026), the latest release - Dependents: 392 - Releases: 87 since 1.0.3 (Jul 11, 2011) - Registry: https://central.sonatype.com/artifact/org.xerial.snappy/snappy-java - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-116590: 1.0.1-rc1 to 1.1.10.8 (1.1.10.9 is outside it) - CVE-2026-108106: 1.0.1-rc1 to 1.1.10.8 (1.1.10.9 is outside it) - CVE-2026-93451: 1.0.1-rc1 to 1.1.10.8 (1.1.10.9 is outside it) - CVE-2023-43642: 1.0.1-rc1 to 1.1.10.3 (1.1.10.4 is outside it) - CVE-2023-34455: 1.0.1-rc1 to 1.1.10.0 (1.1.10.1 is outside it) - CVE-2023-34454: 1.0.1-rc1 to 1.1.10.0 (1.1.10.1 is outside it) - CVE-2023-34453: 1.0.1-rc1 to 1.1.10.0 (1.1.10.1 is outside it) ## Advisories (7) ### [CVE-2026-116590](https://cve.now/CVE-2026-116590): snappy-java: JVM crash from unchecked ranges in Snappy.arrayCopy and SnappyOutputStream.rawWrite - Severity: Medium 5.9 - Published: Oct 26, 2026 - Affected: fixed in 1.1.10.9. - Fixed in 1.1.10.9 (released Oct 3, 2026, 23 days before disclosure). - The latest release, 1.1.10.12, is not affected. ### [CVE-2026-108106](https://cve.now/CVE-2026-108106): Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service - Severity: High 8.7 - Published: Oct 9, 2026 - Affected: fixed in 1.1.10.9. - Fixed in 1.1.10.9 (released Oct 3, 2026, 6 days before disclosure). - The latest release, 1.1.10.12, is not affected. ### [CVE-2026-93451](https://cve.now/CVE-2026-93451): snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods - Severity: Medium 6.9 - Published: Sep 17, 2026 - Affected: fixed in 1.1.10.9. - Fixed in 1.1.10.9 (released Oct 3, 2026, 16 days after disclosure). - The latest release, 1.1.10.12, is not affected. ### [CVE-2023-43642](https://cve.now/CVE-2023-43642): Missing upper bound check on chunk length in snappy-java - Severity: High 7.5 - Published: Sep 25, 2023 - Affected: fixed in 1.1.10.4. - Fixed in 1.1.10.4 (released Sep 23, 2023, 2 days before disclosure). - The latest release, 1.1.10.12, is not affected. ### [CVE-2023-34455](https://cve.now/CVE-2023-34455): snappy-java's unchecked chunk length leads to DoS - Severity: High 7.5 - Published: Jun 15, 2023 - Affected: fixed in 1.1.10.1. - Fixed in 1.1.10.1 (released Jun 14, 2023, 1 day before disclosure). - The latest release, 1.1.10.12, is not affected. ### [CVE-2023-34454](https://cve.now/CVE-2023-34454): snappy-java's Integer Overflow vulnerability in compress leads to DoS - Severity: Medium 5.9 - Published: Jun 15, 2023 - Affected: fixed in 1.1.10.1. - Fixed in 1.1.10.1 (released Jun 14, 2023, 1 day before disclosure). - The latest release, 1.1.10.12, is not affected. ### [CVE-2023-34453](https://cve.now/CVE-2023-34453): snappy-java's Integer Overflow vulnerability in shuffle leads to DoS - Severity: Medium 5.9 - Published: Jun 15, 2023 - Affected: fixed in 1.1.10.1. - Fixed in 1.1.10.1 (released Jun 14, 2023, 1 day before disclosure). - The latest release, 1.1.10.12, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.xerial.snappy:snappy-java Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.