CVE-2026-108106
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
- Record
CVE-2026-108106- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-02
EUVDEUVD-2026-95807
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
- Record
EUVD-2026-95807- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-94x4-5g3f-jjxp
Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-q233-g92q-qxp6. This link is maintained to preserve external references.
Original Description
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
- Record
GHSA-94x4-5g3f-jjxp- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q233-g92q-qxp6
snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha
Impact
Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing OutOfMemoryError (denial of service), or a NegativeArraySizeException for declared lengths of 2^31 or more.
Affected entry points include Snappy.uncompress(byte[]), Snappy.uncompressString, the Snappy.uncompress*Array methods, SnappyInputStream, and SnappyFramedInputStream. The maxChunkSize limit added for CVE-2023-43642 bounds only the compressed chunk length, so it does not prevent this.
Patches
Fixed in 1.1.10.9 (#739). Snappy.uncompressedLength() now rejects negative declared lengths, and lengths larger than any valid Snappy stream of the given size can produce. The densest Snappy element expands 3 bytes to 64, so the limit is 64/3 of the compressed size. Allocations are therefore proportional to the input actually received.
Workarounds
Before decompressing untrusted data, check that Snappy.uncompressedLength(input) is within an application-specific limit.
- Record
GHSA-q233-g92q-qxp6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770, CWE-789
- Updated
- 2026-11-02
NVD
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
- Record
CVE-2026-108106- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-02
OSV
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
- Record
CVE-2026-108106- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-789
- Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
- Record
DEBIAN-CVE-2026-108106- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVGHSA-94x4-5g3f-jjxp
Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-q233-g92q-qxp6. This link is maintained to preserve external references.
Original Description
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
- Record
GHSA-94x4-5g3f-jjxp- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-789
- Updated
- 2026-11-02
OSVGHSA-q233-g92q-qxp6
snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha
Impact
Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing OutOfMemoryError (denial of service), or a NegativeArraySizeException for declared lengths of 2^31 or more.
Affected entry points include Snappy.uncompress(byte[]), Snappy.uncompressString, the Snappy.uncompress*Array methods, SnappyInputStream, and SnappyFramedInputStream. The maxChunkSize limit added for CVE-2023-43642 bounds only the compressed chunk length, so it does not prevent this.
Patches
Fixed in 1.1.10.9 (#739). Snappy.uncompressedLength() now rejects negative declared lengths, and lengths larger than any valid Snappy stream of the given size can produce. The densest Snappy element expands 3 bytes to 64, so the limit is 64/3 of the compressed size. Allocations are therefore proportional to the input actually received.
Workarounds
Before decompressing untrusted data, check that Snappy.uncompressedLength(input) is within an application-specific limit.
- Record
GHSA-q233-g92q-qxp6- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770, CWE-789
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-108106
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
- Record
UBUNTU-CVE-2026-108106- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-108106 No score
CVE-2026-108106 in org.xerial.snappy:snappy-java - Patched by Root
Root has patched CVE-2026-108106 in the org.xerial.snappy:snappy-java package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-108106- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.xerial.snappy:snappy-javaMaven |
through 1.1.10.8 | 1.1.10.9 |
snappy-javaDebian:12 |
All versions, plus listed versions 1.1.10.5-11.1.10.5-21.1.10.7-11.1.10.8-11.1.8.3-1 |
None known |
snappy-javaDebian:13 |
All versions, plus listed versions 1.1.10.7-11.1.10.8-1 |
None known |
snappy-javaDebian:14 |
All versions, plus listed versions 1.1.10.7-11.1.10.8-1 |
None known |
org.xerial.snappy:snappy-javaMaven |
before 1.1.10.9, plus listed versions 1.0.1-rc11.0.1-rc21.0.1-rc31.0.1-rc41.0.3 Show 45 moreShow less1.0.3-rc11.0.3-rc21.0.3-rc31.0.3-rc41.0.3.11.0.3.21.0.3.31.0.41.0.4.11.0.51.0.5-M11.0.5-M21.0.5-M31.0.5-M41.0.5.11.0.5.21.0.5.31.0.5.41.1.01.1.0-M11.1.0-M21.1.0-M31.1.0-M41.1.0.11.1.11.1.1-M11.1.1-M21.1.1-M31.1.1-M41.1.1.11.1.1.21.1.1.31.1.1.41.1.1.51.1.1.61.1.1.71.1.10.01.1.10.11.1.10.21.1.10.31.1.10.41.1.10.51.1.10.61.1.10.71.1.10.8 |
1.1.10.9 |
org.xerial.snappy:snappy-javaRoot:Maven |
before 1.1.10.5-aikido.1 | 1.1.10.5-aikido.11.1.10.8-aikido.1 |
io.root.org.xerial.snappy:snappy-javaRoot:Maven |
before 1.1.10.5-root.io.1 | 1.1.10.5-root.io.11.1.10.8-root.io.1 |
snappy-javaUbuntu:14.04:LTS |
All versions, plus listed versions 1.0.4.1~dfsg-1 |
None known |
snappy-javaUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.1.7-21.1.2-11.1.2.1-2 |
None known |
snappy-javaUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.4-1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
snappy-javaUbuntu:20.04:LTS |
All versions, plus listed versions 1.1.7.2-11.1.7.3-11.1.7.3-1build1 |
None known |
snappy-javaUbuntu:22.04:LTS |
All versions, plus listed versions 1.1.8.3-1 |
None known |
snappy-javaUbuntu:24.04:LTS |
All versions, plus listed versions 1.1.8.3-11.1.10.5-11.1.10.5-1build1 |
None known |
snappy-javaUbuntu:26.10 |
All versions, plus listed versions 1.1.10.8-1 |
None known |
snappy-javaUbuntu:26.04:LTS |
All versions, plus listed versions 1.1.10.7-11.1.10.8-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-108106 is a high vulnerability (CVSS 8.7) in Xerial Snappy-java, published October 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in org.xerial.snappy:snappy-java 1.1.10.9.
References
github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6
vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-108106
security-tracker.debian.org/tracker/CVE-2026-108106
ubuntu.com/security/CVE-2026-108106
cve.org/CVERecord?id=CVE-2026-108106
Left out here: 33 versions. The JSON record has them.