iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash

Vulnerability

CVE-2024-36124 is an out-of-bounds read vulnerability in the iq80 Snappy compression/decompression library for Java. When decompressing specially crafted data, the library attempts to read memory outside the bounds of the provided byte arrays [1]. Because the library uses sun.misc.Unsafe for performance, standard bounds checks are bypassed, making this equivalent to a memory safety issue in native code [3].

Exploitation

An attacker can exploit the vulnerability by supplying maliciously compressed data to an application that uses iq80 Snappy for decompression. No authentication is required — the attack surface is any endpoint that accepts untrusted compressed data (e.g., file upload, network stream) [3]. The use of sun.misc.Unsafe means the out-of-bounds access occurs without any additional validation, leading directly to undefined behavior [1].

Impact

Successful exploitation results in a denial-of-service condition: the JVM may crash or exhibit non-deterministic behavior [1][3]. In theory, improper memory access could also lead to information disclosure or other impacts, though the advisory focuses on DoS [3].

Mitigation

The iq80 Snappy project is no longer actively maintained [1]. Users should upgrade to version 0.5 as a quick fix [3]. For a long-term solution, the recommended migration is to the Snappy implementation in aircompressor (version 0.27 or newer) [3].