snappy-java contains a flaw in Snappy.arrayCopy where caller supplied ranges are passed directly to native memcpy without validating array bounds. The flaw allows negative or oversized byteLength and offset values to read or write outside array bounds, causing a JVM crash. The crash leads to denial of service for any application that uses the affected Snappy functions, potentially impacting server availability.

The vulnerability affects the xerial snappy-java library for all Java applications using versions prior to 1.1.10.9. The specific functions impacted are Snappy.arrayCopy(Object, int, int, Object, int), SnappyOutputStream.rawWrite, and SnappyInputStream.rawRead and their typed-array variants. The remedy applies to any environment that has the library installed; no hardware or OS specific constraints are listed.

The CVSS score of 5.9 indicates a medium severity and the EPSS score is not reported, so the likelihood of exploitation is unknown. The vulnerability is not listed in CISA KEV, suggesting no known public exploitation at the time. The flaw can be triggered by any caller that provides suspicious ranges, so any code that constructs Snappy compression or decompression data may be able to cause a crash. Attack vectors are likely local exploitation where the library is used with untrusted input, or remote if the application exposes the library to external data.