Register | Log in

snappy-java

Choose email to subscribe with

general

source: snappy-java (main)
version: 1.1.10.8-1
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Andreas Tille [DMD] – Charles Plessy [DMD]
arch: all any
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.1.8.3-1
oldstable: 1.1.8.3-1
stable: 1.1.10.7-1
testing: 1.1.10.8-1
unstable: 1.1.10.8-1

versioned links

1.1.8.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.1.10.7-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.1.10.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libsnappy-java
libsnappy-jni

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://github.com/xerial/snappy-java/tags failed: 500 Header line too long (limit is 8192)

Created: 2026-10-24 Last update: 2026-10-29 09:20

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-108104: Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.
CVE-2026-108106: Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.

Created: 2026-10-10 Last update: 2026-10-10 11:00

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2026-108104: Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.
CVE-2026-108106: Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.

Created: 2026-10-10 Last update: 2026-10-10 11:00

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2026-108104: Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.
CVE-2026-108106: Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.

Created: 2026-10-10 Last update: 2026-10-10 11:00

3 security issues in bookworm high

There are 3 open security issues in bookworm.

2 important issues:

CVE-2026-108104: Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.
CVE-2026-108106: Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.

1 issue postponed or untriaged:

CVE-2023-43642: (needs triaging) snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vulnerable to Denial of Service (DoS) attacks when decompressing data with a too large chunk size. Due to missing upper bound check on chunk length, an unrecoverable fatal error can occur. All versions of snappy-java including the latest released version 1.1.10.3 are vulnerable to this issue. A fix has been introduced in commit `9f8c3cf74` which will be included in the 1.1.10.4 release. Users are advised to upgrade. Users unable to upgrade should only accept compressed data from trusted sources.

Created: 2026-10-10 Last update: 2026-10-10 11:00

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

libsnappy-jni could be marked Multi-Arch: same

Created: 2026-01-22 Last update: 2026-10-29 08:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.2).

Created: 2025-12-23 Last update: 2026-03-31 15:01

news

[2025-08-14] snappy-java 1.1.10.8-1 MIGRATED to testing (Debian testing watch)
[2025-08-08] Accepted snappy-java 1.1.10.8-1 (source) into unstable (tony mancill)
[2024-11-23] snappy-java 1.1.10.7-1 MIGRATED to testing (Debian testing watch)
[2024-11-18] Accepted snappy-java 1.1.10.7-1 (source) into unstable (tony mancill)
[2024-04-13] snappy-java 1.1.10.5-2 MIGRATED to testing (Debian testing watch)
[2024-04-07] Accepted snappy-java 1.1.10.5-2 (source) into unstable (tony mancill)
[2023-10-10] snappy-java 1.1.10.5-1 MIGRATED to testing (Debian testing watch)
[2023-10-05] Accepted snappy-java 1.1.10.5-1 (source) into unstable (tony mancill)
[2021-01-30] snappy-java 1.1.8.3-1 MIGRATED to testing (Debian testing watch)
[2021-01-25] Accepted snappy-java 1.1.8.3-1 (source) into unstable (Emmanuel Bourg)
[2020-09-22] snappy-java 1.1.7.7-1 MIGRATED to testing (Debian testing watch)
[2020-09-16] Accepted snappy-java 1.1.7.7-1 (source) into unstable (Emmanuel Bourg)
[2020-06-21] snappy-java 1.1.7.5-1 MIGRATED to testing (Debian testing watch)
[2020-06-15] Accepted snappy-java 1.1.7.5-1 (source) into unstable (Emmanuel Bourg)
[2020-02-01] snappy-java 1.1.7.3-1 MIGRATED to testing (Debian testing watch)
[2020-01-26] Accepted snappy-java 1.1.7.3-1 (source) into unstable (Emmanuel Bourg)
[2018-10-10] snappy-java 1.1.7.2-1 MIGRATED to testing (Debian testing watch)
[2018-10-04] Accepted snappy-java 1.1.7.2-1 (source) into unstable (Emmanuel Bourg)
[2018-05-08] snappy-java 1.1.7.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2018-05-03] Accepted snappy-java 1.1.7.1+dfsg-1 (source) into unstable (Andreas Tille)
[2017-06-25] snappy-java 1.1.4-1 MIGRATED to testing (Debian testing watch)
[2017-06-24] Accepted snappy-java 1.1.2.6-1~bpo8+1 (source all amd64) into jessie-backports->backports-policy, jessie-backports (Andreas Tille)
[2017-06-20] Accepted snappy-java 1.1.4-1 (source) into unstable (Emmanuel Bourg)
[2016-07-14] snappy-java 1.1.2.6-1 MIGRATED to testing (Debian testing watch)
[2016-07-08] Accepted snappy-java 1.1.2.6-1 (source all amd64) into unstable (Emmanuel Bourg)
[2016-04-12] Accepted snappy-java 1.1.2.4-3~bpo8+1 (source all amd64) into jessie-backports, jessie-backports (Andreas Tille)
[2016-04-11] snappy-java 1.1.2.4-3 MIGRATED to testing (Debian testing watch)
[2016-04-05] Accepted snappy-java 1.1.2.4-3 (source all amd64) into unstable (Emmanuel Bourg)
[2016-03-03] snappy-java 1.1.2.1-2 MIGRATED to testing (Debian testing watch)
[2016-02-25] Accepted snappy-java 1.1.2.1-2 (source all amd64) into unstable (Emmanuel Bourg)

1
2

bugs [bug history graph]

all: 3
RC: 0
I&N: 2
M&W: 1
F&P: 0
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.1.10.8-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing