CVE-2026-108106: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha
Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing OutOfMemoryError (denial of service), or a NegativeArraySizeException for declared lengths of 2^31 or more.
Affected entry points include Snappy.uncompress(byte[]), Snappy.uncompressString, the Snappy.uncompress*Array methods, SnappyInputStream, and SnappyFramedInputStream. The maxChunkSize limit added for CVE-2023-43642 bounds only the compressed chunk length, so it does not prevent this.
References
- github.com/advisories/GHSA-q233-g92q-qxp6
- github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java
- github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75
- github.com/xerial/snappy-java/pull/739
- github.com/xerial/snappy-java/releases/tag/v1.1.10.9
- github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6
- nvd.nist.gov/vuln/detail/CVE-2026-108106
- www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service
Code Behaviors & Features
Detect and mitigate CVE-2026-108106 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →