From 4a42e07ce36ace351686151846e8c50110f83756 Mon Sep 17 00:00:00 2001
From: "Taro L. Saito" <leo@xerial.org>
Date: Sat, 3 Oct 2026 10:49:30 -0700
Subject: [PATCH] [GHSA-mrhq-xxpp-qf7j] Add affected package and fixed version
 for snappy-java

---
 .../GHSA-mrhq-xxpp-qf7j.json                  | 43 ++++++++++++++++++-
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/advisories/unreviewed/2026/09/GHSA-mrhq-xxpp-qf7j/GHSA-mrhq-xxpp-qf7j.json b/advisories/unreviewed/2026/09/GHSA-mrhq-xxpp-qf7j/GHSA-mrhq-xxpp-qf7j.json
index 557af323e0f2..21831d91c900 100644
--- a/advisories/unreviewed/2026/09/GHSA-mrhq-xxpp-qf7j/GHSA-mrhq-xxpp-qf7j.json
+++ b/advisories/unreviewed/2026/09/GHSA-mrhq-xxpp-qf7j/GHSA-mrhq-xxpp-qf7j.json
@@ -17,7 +17,30 @@
       "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
     }
   ],
-  "affected": [],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Maven",
+        "name": "org.xerial.snappy:snappy-java"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.1.10.9"
+            }
+          ]
+        }
+      ],
+      "database_specific": {
+        "last_known_affected_version_range": "<= 1.1.10.8"
+      }
+    }
+  ],
   "references": [
     {
       "type": "ADVISORY",
@@ -25,10 +48,26 @@
     },
     {
       "type": "WEB",
-      "url": "https://github.com/xerial/snappy-java/issues/728"
+      "url": "https://github.com/xerial/snappy-java/security/advisories/GHSA-wmgv-28fv-894x"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xerial/snappy-java/pull/739"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9"
     },
     {
       "type": "WEB",
+      "url": "https://github.com/xerial/snappy-java/issues/728"
+    },
+    {
+      "type": "PACKAGE",
       "url": "https://github.com/xerial/snappy-java"
     },
     {