Unbounded Memory Allocation Vulnerability in Xerial Snappy-Java

CVE-2026-108106

What is CVE-2026-108106?

Xerial Snappy-Java prior to version 1.1.10.9 is susceptible to an unbounded memory allocation vulnerability. By crafting specific inputs with large uncompressed length values, attackers can exploit methods such as Snappy.uncompress, uncompressString, SnappyInputStream, or SnappyFramedInputStream. This exploitation leads to excessive memory allocation, potentially consuming up to 2 GB, resulting in an OutOfMemoryError and causing denial of service. It is crucial for users running affected versions to update immediately to mitigate this risk.

References