Xerial
Vulnerability activity for Xerial: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.9MediumOct 26, 2026Xerial snappy-javaCVE-2026-116590snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and rea
- 4.8MediumOct 9, 2026Xerial snappy-java Memory corruptionCVE-2026-108104Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.
- 7.5HighSep 18, 2026Xerial snappy-java Memory corruptionCVE-2026-93452snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and causing JVM termination.
- 7.5HighSep 12, 2026Xerial snappy-java Memory corruptionCVE-2026-90559snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.
- 7.5HighSep 25, 2023Xerial snappy-java Denial of serviceCVE-2023-43642snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverabl1.2% likely
- 7.5HighJun 15, 2023Xerial snappy-java Denial of serviceCVE-2023-34455snappy-java is a fast compressor/decompressor for Java. Due to use of an unchecked chunk length, an unrecoverable fatal error can occur in versions prior to 1.1.10.1. The code in the function hasNextChunk in the fileSnappyInputStream.java checks if a given stream has more chunks to read. It does th1.8% likely
Top products
- snappy-java4 CVEs in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Atlassian · Mar 19, 2024Atlassian Security Bulletin March 19, 2024CVE-2023-34455
- Atlassian · Jan 16, 2024Atlassian Security Bulletin January 16, 2024CVE-2023-34455CVE-2023-43642
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.