CVE-2026-90559 Overview
CVE-2026-90559 is an out-of-bounds write vulnerability [CWE-787] in the snappy-java library through version 1.1.10.8. The flaw resides in the Snappy.uncompress(ByteBuffer, ByteBuffer) method, which fails to validate that the destination buffer has sufficient capacity to hold the decompressed output. Attackers can craft valid compressed payloads that expand beyond the destination buffer size, triggering writes past the buffer boundary. The result is Java Virtual Machine (JVM) termination and a denial-of-service condition in any application processing untrusted Snappy-compressed data.
Critical Impact
Remote attackers can crash the JVM of any service that decompresses attacker-controlled Snappy data using the vulnerable ByteBuffer overload, causing service-wide denial of service.
Affected Products
- snappy-java library versions through 1.1.10.8
- Java applications invoking Snappy.uncompress(ByteBuffer, ByteBuffer) on untrusted input
- Downstream frameworks and data pipelines bundling vulnerable snappy-java (for example, messaging, streaming, and columnar storage stacks)
Discovery Timeline
- 2026-09-12 - CVE-2026-90559 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-90559
Vulnerability Analysis
The vulnerability affects the Snappy.uncompress(ByteBuffer, ByteBuffer) entry point in snappy-java. The method accepts a source ByteBuffer containing compressed data and a destination ByteBuffer intended to receive the decompressed bytes. The implementation reads the uncompressed size embedded in the Snappy stream header and proceeds to decompress without comparing that value to the remaining capacity of the destination buffer.
When the decompressed length exceeds the destination's available space, native decompression writes past the buffer boundary. Because the write occurs through direct memory access in native code, the JVM aborts rather than raising a catchable Java exception. Applications performing bulk decompression of external data terminate immediately, taking any co-hosted workloads with them.
Root Cause
The root cause is missing bounds validation between the header-declared decompressed size and the destination buffer capacity. See the vulnerable code path in the GitHub Snappy.java Code Reference and the maintainer discussion in GitHub Snappy-Java Issue #728.
Attack Vector
Exploitation requires only that the target application decompress attacker-supplied Snappy data through the vulnerable ByteBuffer overload. No authentication or user interaction is required. Common exposure paths include message brokers, log ingestion pipelines, RPC frameworks, and any HTTP or gRPC endpoint accepting Snappy-compressed payloads. Refer to the VulnCheck Advisory for Snappy-Java for further exploitation context.
No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose per the referenced advisories.
Detection Methods for CVE-2026-90559
Indicators of Compromise
- Unexpected JVM crashes producing hs_err_pid*.log files referencing org.xerial.snappy native frames
- Sudden termination of Java services immediately after processing inbound compressed payloads
- Repeated segmentation faults in processes loading libsnappyjava.so or snappyjava.dll
Detection Strategies
- Inventory application dependencies for org.xerial.snappy:snappy-java at versions <= 1.1.10.8 using Software Composition Analysis (SCA) tooling
- Monitor JVM fatal error logs for native-frame crashes involving Snappy decompression routines
- Correlate service restart events with inbound requests carrying Snappy-encoded content types or headers
Monitoring Recommendations
- Alert on abnormal Java process exit codes across production hosts and containers
- Ingest JVM crash dumps into centralized logging for pattern-based identification
- Track request payload size and content-encoding anomalies at the API gateway layer
How to Mitigate CVE-2026-90559
Immediate Actions Required
- Upgrade snappy-java to the fixed release published by the maintainer as tracked in GitHub Snappy-Java Issue #728
- Audit direct and transitive dependencies across build manifests (pom.xml, build.gradle) for vulnerable versions
- Rebuild and redeploy affected services after dependency remediation
Patch Information
Upstream fixes and release status are maintained in the GitHub Snappy-Java Repository. Consumers should update to the latest published release beyond 1.1.10.8 and verify the transitive dependency graph in all downstream artifacts.
Workarounds
- Validate the decompressed size header of incoming Snappy streams against a maximum acceptable bound before invoking Snappy.uncompress
- Prefer the byte[] overload with pre-sized destination arrays computed from Snappy.uncompressedLength() where feasible
- Reject or quarantine Snappy payloads originating from untrusted network sources at ingress
# Example Maven dependency pin (replace with the fixed version once published)
mvn dependency:tree -Dincludes=org.xerial.snappy:snappy-java
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
