CVE-2026-108104: Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
xerial/snappy-javato a version that resolves this vulnerability.Fixed in 1.1.10.10
Event History
Frequently Asked Questions
Which applications are most exposed to this issue?
Applications using snappy-java versions from 1.1.7.4 through versions before 1.1.10.10 are exposed when they process attacker-supplied Snappy framed data. The impact involves shared backing arrays, which can expose or overwrite decompressed data belonging to other streams.
What must an attacker do to trigger the vulnerability?
The attacker must supply framed data with a large declared chunk length. This must cause replacement buffer allocation to fail with an OutOfMemoryError, leading the affected input stream to return a pooled buffer twice.
How can I determine whether my deployment is affected?
Check the resolved Maven dependency version for org.xerial.snappy:snappy-java. Versions starting at 1.1.7.4 and earlier than 1.1.10.10 are affected; version 1.1.10.10 is the referenced fixed release.