CVE-2026-69702: SnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOM
SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated framecontentsize field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causing the JVM to attempt an unbounded array allocation and triggering an unrecoverable java.lang.OutOfMemoryError when the task is dispatched through the retry-task pipeline.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SnailJobto a version that resolves this vulnerability.Fixed in 1.7.0 - Configuration
Harden FuryUtil.deserialize by rejecting Zstandard payloads that declare an inflated frame_content_size/decompressed size in the frame header to prevent unbounded array allocation leading to java.lang.OutOfMemoryError.
FuryUtil.deserialize frame_content_size (Zstandard frame header) handling = reject inflated/declared decompressed sizes
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69702?
CVE-2026-69702 has a medium severity rating of 6.5.
How does the denial of service occur in CVE-2026-69702?
The denial of service in CVE-2026-69702 occurs when authenticated attackers use a crafted Zstandard-compressed payload to crash the server.
What version of SnailJob is affected by CVE-2026-69702?
CVE-2026-69702 affects SnailJob version 1.7.0.
What type of attack can exploit CVE-2026-69702?
CVE-2026-69702 can be exploited by authenticated attackers, leading to a denial of service.
What is the recommended action to mitigate CVE-2026-69702?
To mitigate CVE-2026-69702, it is recommended to upgrade to a newer, patched version of SnailJob.