CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-93451

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.

Score
6.9 medium
Published
2026-09-17
Links
NVD · cve.org · Report wrong data

Matched ports (1)

PortPackageVersionStatusMaintainer
archivers/snappy-javasnappyjava1.1.10.8_2unaddressedlanguage.devel@gmail.com

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>snappyjava</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>snappy-java through 1.1.10.8 contains a buffer overflow vulnerability
	in typed Snappy.uncompress*Array methods that allocate output arrays
	by dividing uncompressed length by element size but pass the undivided
	length to native code. Attackers controlling compressed input can
	cause misaligned length values to write past array bounds with
	attacker-controlled bytes, corrupting heap memory.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-93451</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-93451</url>
    </references>
    <dates>
      <discovery>2026-09-17</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>