CVE-2026-93451

{
  "etk_id": "ETK-2026-2798",
  "cve_id": "CVE-2026-93451",
  "display_id": "CVE-2026-93451",
  "ghsa_id": "GHSA-gwq9-9ffj-mvrv",
  "euvd_id": "EUVD-2026-82603",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Heap buffer overflow in snappy-java typed-array decompression",
  "summary": "snappy-java through 1.1.10.8 mishandles declared output lengths in typed-array decompression methods. An attacker who can supply compressed input to an application that calls an affected method may corrupt heap memory when the declared length is not aligned to the array element size.",
  "mitigation": "Upgrade org.xerial.snappy:snappy-java to version 1.1.10.9 or later. Until upgraded, reject inputs whose reported uncompressed length is not divisible by the element size before invoking the typed-array decompression APIs.",
  "vendor": "maven",
  "product": "maven:org.xerial.snappy:snappy-java",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.1.10.8"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "1.1.10.9"
      ],
      "package_name": "org.xerial.snappy:snappy-java",
      "purl": "pkg:maven/org.xerial.snappy/snappy-java"
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.617203866666667,
  "t0_at": "2026-09-17T23:25:11.585000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-17T23:25:11.585000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-17T23:25:11.585000+00:00",
      "url": "https://github.com/advisories/GHSA-gwq9-9ffj-mvrv"
    }
  }
}