CVE-2026-108106: Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using snappy-java before 1.1.10.9 are exposed if they pass attacker-controlled or otherwise untrusted compressed Snappy data to Snappy.uncompress, uncompressString, SnappyInputStream, or SnappyFramedInputStream.
What does an attacker need to exploit it?
An attacker only needs to supply crafted compressed input that declares a very large uncompressed length. The input can be only a few bytes, and no authentication, user interaction, or special conditions are indicated.
What is the operational impact?
The affected decompression paths can allocate up to 2 GB of JVM memory based on the declared length. This can trigger OutOfMemoryError and deny service to the affected application.
How can I remediate the issue?
Upgrade org.xerial.snappy:snappy-java to version 1.1.10.9 or later. If an immediate upgrade is not possible, avoid passing untrusted compressed input to the affected Snappy decompression APIs.