CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2026-90559

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.

Score
8.7 high
Published
2026-09-12
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
archivers/snappy-javasnappyjava1.1.10.8_2unaddressedlanguage.devel@gmail.com

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>snappyjava</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>snappy-java through 1.1.10.8 contains an out-of-bounds write
	vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because
	destination buffer capacity is never validated against decompressed
	size. Attackers can supply valid compressed data that decompresses
	larger than the destination buffer, causing writes past buffer
	boundaries and JVM termination.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-90559</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-90559</url>
    </references>
    <dates>
      <discovery>2026-09-12</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>