GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-36124 (GCVE-0-2024-36124)

Vulnerability from cvelistv5 – Published: 2024-06-03 14:25 – Updated: 2024-09-05 14:44
VLAI
Title
iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash
Summary
iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.
Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-08-06 18:26 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
dain snappy Affected: < 0.5
guessed Create a notification for this product.
xerial snappy-java Affected: 0 , < 0.5 (custom)
    cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:30:13.077Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "snappy-java",
            "vendor": "xerial",
            "versions": [
              {
                "lessThan": "0.5",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36124",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-06T18:26:25.852205Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-05T14:44:12.984Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "snappy",
          "vendor": "dain",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-03T14:25:58.628Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9"
        }
      ],
      "source": {
        "advisory": "GHSA-8wh2-6qhj-h7j9",
        "discovery": "UNKNOWN"
      },
      "title": "iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-36124",
    "datePublished": "2024-06-03T14:25:58.628Z",
    "dateReserved": "2024-05-20T21:07:48.189Z",
    "dateUpdated": "2024-09-05T14:44:12.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-36124",
      "date": "2026-09-16",
      "epss": "0.00487",
      "percentile": "0.40759"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.\\n\"}, {\"lang\": \"es\", \"value\": \"iq80 Snappy es una librer\\u00eda de compresi\\u00f3n/descompresi\\u00f3n. Al descomprimir ciertos datos, Snappy intenta leer fuera de los l\\u00edmites de las matrices de bytes dadas. Debido a que Snappy usa la clase JDK `sun.misc.Unsafe` para acelerar el acceso a la memoria, no se realizan comprobaciones de los l\\u00edmites adicionales y esto tiene consecuencias de seguridad similares a las del acceso fuera de los l\\u00edmites en C o C++, es decir, puede conducir a no comportamiento determinista o bloquear la JVM. iq80 Snappy ya no recibe mantenimiento activo. Como soluci\\u00f3n r\\u00e1pida, los usuarios pueden actualizar a la versi\\u00f3n 0.5.\"}]",
      "id": "CVE-2024-36124",
      "lastModified": "2024-11-21T09:21:40.357",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 1.4}]}",
      "published": "2024-06-03T15:15:09.090",
      "references": "[{\"url\": \"https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36124\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-06-03T15:15:09.090\",\"lastModified\":\"2026-06-17T07:36:09.277\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.\\n\"},{\"lang\":\"es\",\"value\":\"iq80 Snappy es una librer\u00eda de compresi\u00f3n/descompresi\u00f3n. Al descomprimir ciertos datos, Snappy intenta leer fuera de los l\u00edmites de las matrices de bytes dadas. Debido a que Snappy usa la clase JDK `sun.misc.Unsafe` para acelerar el acceso a la memoria, no se realizan comprobaciones de los l\u00edmites adicionales y esto tiene consecuencias de seguridad similares a las del acceso fuera de los l\u00edmites en C o C++, es decir, puede conducir a no comportamiento determinista o bloquear la JVM. iq80 Snappy ya no recibe mantenimiento activo. Como soluci\u00f3n r\u00e1pida, los usuarios pueden actualizar a la versi\u00f3n 0.5.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"dain\",\"product\":\"snappy\",\"versions\":[{\"version\":\"\u003c 0.5\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"xerial\",\"product\":\"snappy-java\",\"defaultStatus\":\"unknown\",\"cpes\":[\"cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"0\",\"lessThan\":\"0.5\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-08-06T18:26:25.852205Z\",\"id\":\"CVE-2024-36124\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:dain:snappy:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"0.5\",\"matchCriteriaId\":\"7526897D-1392-492D-B5A4-E00D2CE278D4\"}]}]}],\"references\":[{\"url\":\"https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:03:40+00:00",
      "cve": "CVE-2024-36124",
      "id": "CVE-2024-36124",
      "initial_release_date": "2024-06-04T00:00:00+00:00",
      "product_status:known_affected": "15",
      "product_status:known_not_affected": "12",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "snappy: tries to read outside the bounds of the given byte arrays",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-36124.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9\", \"name\": \"https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9\", \"tags\": [\"x_refsource_CONFIRM\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:30:13.077Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-36124\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-06T18:26:25.852205Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*\"], \"vendor\": \"xerial\", \"product\": \"snappy-java\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"0.5\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-03T15:58:39.509Z\"}}], \"cna\": {\"title\": \"iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash\", \"source\": {\"advisory\": \"GHSA-8wh2-6qhj-h7j9\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"dain\", \"product\": \"snappy\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 0.5\"}]}], \"references\": [{\"url\": \"https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9\", \"name\": \"https://github.com/dain/snappy/security/advisories/GHSA-8wh2-6qhj-h7j9\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class `sun.misc.Unsafe` to speed up memory access, no additional bounds checks are performed and this has similar security consequences as out-of-bounds access in C or C++, namely it can lead to non-deterministic behavior or crash the JVM. iq80 Snappy is not actively maintained anymore. As quick fix users can upgrade to version 0.5.\\n\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-125\", \"description\": \"CWE-125: Out-of-bounds Read\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-06-03T14:25:58.628Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-36124\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-05T14:44:12.984Z\", \"dateReserved\": \"2024-05-20T21:07:48.189Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-06-03T14:25:58.628Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.