CVE-2026-90559 is reported against latest version 1.1.10.8 #738

Activity

1. TonyOlaCodes commented on Sep 29, 2026

   

   TonyOlaCodes

   on Sep 29, 2026

   More actions

   Hi, I'm checking the status of CVE-2026-90559 affecting snappy-java version 1.1.10.8. We are using this library as a dependency in a product and have been flagged by our security scanner.

   Is a fix planned? If so, could you share the expected fixed version and an approximate release date? Is there a recommended workaround in the meantime?

   Thanks!
2. xerial commented on Oct 3, 2026

   

   xerial

   on Oct 3, 2026

   Owner

   More actions

   CVE-2026-90559 (#728) is fixed in #739, now merged to main: Snappy.uncompress(ByteBuffer, ByteBuffer) checks the destination capacity before calling native code. The fix will ship in 1.1.10.9. Until then, check uncompressed.remaining() >= Snappy.uncompressedLength(compressed) before calling it.
3. xerial

   closed this as completedon Oct 3, 2026