{"id":"ECHO-49f5-2d75-9004","upstream":["CVE-2026-90559","GHSA-mrhq-xxpp-qf7j"],"severity":[],"modified":"2026-10-22T07:45:58.046Z","affected":[{"package":{"ecosystem":"Echo:Maven","name":"org.xerial.snappy:snappy-java","purl":"pkg:maven/org.xerial.snappy/snappy-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10.8+echo.1"}]}]}],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-90559"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90559"},{"type":"WEB","url":"https://github.com/xerial/snappy-java/issues/728"},{"type":"WEB","url":"https://github.com/xerial/snappy-java"},{"type":"WEB","url":"https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L561"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/snappy-java-through-1.1.10.8-out-of-bounds-write-via-uncompress"},{"type":"WEB","url":"https://github.com/advisories/GHSA-mrhq-xxpp-qf7j"}]}