CVE-2024-36124CWE-125

iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash

Medium · published June 3, 2024

CVSS v3.1
5.3
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00487 · 41.0th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2024-06-03T14:25Z
EPSS history
Timeline
  • 03 JUN 14:25Z
    iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash
    cvelistv5