{"id":"CVE-2026-108106","kind":"vulnerability","aliases":["CVE-2026-108106","GHSA-q233-g92q-qxp6"],"related":[],"title":"snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha","description":"### Impact\nSeveral decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing `OutOfMemoryError` (denial of service), or a `NegativeArraySizeException` for declared lengths of 2^31 or more.\n\nAffected entry points include `Snappy.uncompress(byte[])`, `Snappy.uncompressString`, the `Snappy.uncompress*Array` methods, `SnappyInputStream`, and `SnappyFramedInputStream`. The `maxChunkSize` limit added for CVE-2023-43642 bounds only the compressed chunk length, so it does not prevent this.\n\n### Patches\nFixed in 1.1.10.9 (#739). `Snappy.uncompressedLength()` now rejects negative declared lengths, and lengths larger than any valid Snappy stream of the given size can produce. The densest Snappy element expands 3 bytes to 64, so the limit is 64/3 of the compressed size. Allocations are therefore proportional to the input actually received.\n\n### Workarounds\nBefore decompressing untrusted data, check that `Snappy.uncompressedLength(input)` is within an application-specific limit.","summary":"snappy-java allocates an output buffer sized by the uncompressed length declared in the first bytes of its input, before checking the data. A few bytes of crafted compressed input can force a near 2 GB allocation, causing an OutOfMemoryError or NegativeArraySizeException and a denial of service.","severity":"high","cvss":8.7,"epss":0.00371,"exploited":false,"exploited_at":null,"products":[{"name":"org.xerial.snappy:snappy-java","fixed":["1.1.10.9"],"affected":"<= 1.1.10.8","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-770","cwe-789","internet-facing","java","maven","package","snappy-java"],"not_affected_if":["patched-version","trusted-input-only"],"how_to_check":"- Run `mvn dependency:tree | grep snappy-java` in the project and read the resolved version.\n- Check whether the application decompresses untrusted input with `Snappy.uncompress`, `Snappy.uncompressString`, `SnappyInputStream` or `SnappyFramedInputStream`.","fix":"- Upgrade `org.xerial.snappy:snappy-java` to `1.1.10.9` or later.\n- Until upgraded, call `Snappy.uncompressedLength(input)` and reject input whose declared length exceeds an application-specific limit before decompressing.","status":"open","published_at":"2026-10-09T15:17:11+00:00","first_seen_at":"2026-10-27T15:34:04+00:00","triaged_at":"2026-10-27T15:35:38+00:00","updated_at":"2026-10-27T16:03:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-27T15:35:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `org.xerial.snappy:snappy-java` to `1.1.10.9` or later.\n- Until upgraded, call `Snappy.uncompressedLength(input)` and reject input whose declared length exceeds an application-specific limit before decompressing.","reach":"unknown","title":"snappy-java: crafted input forces a 2 GB allocation, crashing the process","impact":"low","summary":"snappy-java allocates an output buffer sized by the uncompressed length declared in the first bytes of its input, before checking the data. A few bytes of crafted compressed input can force a near 2 GB allocation, causing an OutOfMemoryError or NegativeArraySizeException and a denial of service.","category":"package","nicknames":[],"who_cares":["java","maven","snappy-java","internet-facing"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker crashes the service with a few bytes of crafted input.","analyst_note":"","how_to_check":"- Run `mvn dependency:tree | grep snappy-java` in the project and read the resolved version.\n- Check whether the application decompresses untrusted input with `Snappy.uncompress`, `Snappy.uncompressString`, `SnappyInputStream` or `SnappyFramedInputStream`.","needs_analyst":false,"not_affected_if":["patched-version","trusted-input-only"],"who_is_affected":"Applications that depend on snappy-java at 1.1.10.8 or earlier and decompress data that an outside party can supply, such as request bodies, uploaded files or messages from other systems. Services that only decompress data they produce themselves are much less exposed. Teams on 1.1.10.9 or later are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000687,"input_tokens":3730,"output_tokens":627,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-108106':15A,23A '-2023':172C '-2026':14A,22A '-43642':173C '-770':29B '-789':31B '1.1.10.9':189C '2':76B,134C,148C '3':216C '31':149C '64':219C '64/3':224C '739':190C 'actual':236C 'add':169C 'affect':152C 'alloc':6A,44B,78B,97C,130C,229C 'applic':251C 'application-specif':250C 'array':161C 'attack':9A 'attacker-declar':8A 'bound':174C 'buffer':47B,100C 'byte':57B,67B,110C,122C,157C,217C 'caus':79B,136C 'check':62B,243C 'chunk':178C 'compress':70B,113C,177C,227C 'craft':69B,124C 'cve':13A,21A,171C 'cwe':28B,30B 'data':64B,114C,242C 'declar':10A,53B,106C,145C,195C 'decompress':91C,116C,240C 'denial':86B,138C 'densest':212C 'element':214C 'entri':153C 'expand':215C 'face':34B 'first':56B,109C 'fix':187C 'forc':73B,128C 'g92q':19A 'gb':77B,135C 'ghsa':17A 'ghsa-q233-g92q-qxp6':16A 'given':207C 'impact':89C 'includ':155C 'input':60B,71B,125C,235C,246C 'internet':33B 'internet-fac':32B 'java':3A,27A,35B,40B,43B,96C 'larger':199C 'length':52B,105C,146C,179C,196C,198C 'lengtha':12A 'limit':168C,222C,253C 'maven':36B 'maxchunks':167C 'memori':5A 'method':162C 'near':75B 'negat':194C 'negativearraysizeexcept':83B,143C 'org.xerial.snappy':24A 'outofmemoryerror':81B,137C 'output':46B,99C 'packag':37B 'patch':186C 'path':92C 'point':154C 'prevent':184C 'produc':210C 'proport':232C 'q233':18A 'qxp6':20A 'receiv':237C 'reject':193C 'servic':88B,140C 'sever':90C 'size':48B,101C,208C,228C 'snappi':2A,39B,42B,95C,203C,213C 'snappy':26A 'snappy-java':1A,25A,38B,41B,94C 'snappy.uncompress':156C,160C 'snappy.uncompressedlength':191C,245C 'snappy.uncompressstring':158C 'snappyframedinputstream':165C 'snappyinputstream':163C 'specif':252C 'stream':204C 'therefor':127C,231C 'unbound':4A 'uncompress':11A,51B,104C 'untrust':241C 'valid':118C,202C 'within':248C 'workaround':238C","nicknames":[],"mitigations":[],"who_affected":"Applications that depend on snappy-java at 1.1.10.8 or earlier and decompress data that an outside party can supply, such as request bodies, uploaded files or messages from other systems. Services that only decompress data they produce themselves are much less exposed. Teams on 1.1.10.9 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T15:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-q233-g92q-qxp6","url":"https://github.com/advisories/GHSA-q233-g92q-qxp6","severity":"high","published_at":"2026-10-27T15:33:22+00:00","modified_at":"2026-10-27T15:33:24+00:00","first_seen_at":"2026-10-27T15:34:04+00:00","fetched_at":"2026-10-27T15:34:04+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-108106","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108106","severity":null,"published_at":"2026-10-09T15:17:11+00:00","modified_at":"2026-10-13T17:17:19+00:00","first_seen_at":"2026-10-27T16:03:35+00:00","fetched_at":"2026-10-27T16:03:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}