Denial of Service Vulnerability in SnailJob by Aizuda
CVE-2026-69702

7.1HIGH

Key Information:

Vendor: Aizuda
Status: Snailjob (snail-job)
Vendor: CVE Published:; 4 August 2026

What is CVE-2026-69702?

The SnailJob 1.7.0 version is vulnerable to a denial of service attack due to an issue in the FuryUtil.deserialize helper. Authenticated attackers can exploit this vulnerability by sending a crafted Zstandard-compressed payload that specifies an inflated frame_content_size in the header. This payload enables attackers to store a base64-encoded Zstandard payload that claims an excessively large decompressed size. Consequently, this results in unbounded array allocation within the Java Virtual Machine (JVM), culminating in an unrecoverable java.lang.OutOfMemoryError when the task is processed through the retry-task pipeline. Mitigation is essential to prevent server crashes and maintain service availability.