CVE-2026-44302: Snappier has an infinite loop during SnappyStream decompression with malformed framed input

May 6, 2026 (updated May 13, 2026)

Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes.

References

github.com/advisories/GHSA-pggp-6c3x-2xmx
github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx
nvd.nist.gov/vuln/detail/CVE-2026-44302

Code Behaviors & Features

Detect and mitigate CVE-2026-44302 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →