Description
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
xerial snappy-java
Default version status: unaffected
1.1.7.4 to < 1.1.10.10affected1.1.10.10unaffected
pkg:maven/org.xerial.snappy/snappy-javaReferences
- https://github.com/xerial/snappy-java/security/advisories/GHSA-c73m-r934-8qvg ↗
- https://github.com/xerial/snappy-java/commit/139a53090a6662298924fd75d21f4769b4a219ea ↗
- https://github.com/xerial/snappy-java/releases/tag/v1.1.10.10 ↗
- https://github.com/xerial/snappy-java/blob/v1.1.10.9/src/main/java/org/xerial/snappy/SnappyFramedInputStream.java#L243 ↗
- https://github.com/xerial/snappy-java ↗
- https://www.vulncheck.com/advisories/xerial-snappy-java-1.1.7.4-before-1.1.10.10-double-release-of-pooled-buffers-in-snappyframedinputstream ↗