Double Release Vulnerability in Xerial Snappy-Java Library

CVE-2026-108104

What is CVE-2026-108104?

The vulnerability in Xerial's snappy-java library arises from a flaw in the SnappyFramedInputStream component, where improper handling of pooled buffers can result in a double release condition. This can occur when an attacker crafts framed data with an excessively large declared chunk length, leading to an OutOfMemoryError. As a consequence, shared backing arrays may inadvertently expose or overwrite decompressed data from other streams, presenting significant data security risks.

References