Xerial snappy-java: Unbounded memory allocation causes denial of service

Summary

snappy-java before version 1.1.10.9 allocates output buffers based on an uncompressed length declared in the compressed input, before the data is validated. A remote attacker can send a few crafted bytes to affected decompression methods and force allocations of up to 2 GB, which leads to OutOfMemoryError and a denial of service in the Java application. Exposure depends on whether a Java service decompresses untrusted data; the vulnerability does not allow code execution or data disclosure according to the CVSS vector.

Affected

• Xerial snappy-java versions before 1.1.10.9 (all versions below 1.1.10.9)
• Affected methods include Snappy.uncompress, uncompressString, the uncompress*Array methods, SnappyInputStream and SnappyFramedInputStream
• Transitive dependencies, for example in Kafka clients, Spark or Avro, may include the affected library

Fixed in

• Upgrade to snappy-java 1.1.10.9 or later; the latest 1.1.10.x release is recommended
• Vendor fix in release v1.1.10.9 (Fix buffer overflows and unbounded allocations from untrusted input)

Workaround

• Before decompressing untrusted data, check Snappy.uncompressedLength(input) against an application-specific maximum (secondary source, verify against the vendor advisory)
• Limit process memory or JVM heap size to contain the impact; this is not a fix
• Existing limits for CVE-2023-43642 do not prevent this issue

Exploitation

• CISA SSVC: Exploitation none, Automatable yes, Technical Impact partial
• No reports of exploitation in the wild or public proof-of-concept code found in the reviewed sources; CISA KEV was not checked directly

Our recommendation

• Inventory Java applications and vendor products for snappy-java, including transitive dependencies in SBOMs and Maven/Gradle files
• Upgrade to 1.1.10.9 at minimum, preferably the latest 1.1.10.x release
• Prioritize internet-facing Java services that decompress untrusted data
• Apply the uncompressedLength check as interim mitigation where patching is delayed
• Monitor logs for OutOfMemoryError events

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Vendor advisory GHSA-q233-g92q-qxp6 github.com
• Release v1.1.10.9 github.com
• OSV CVE-2026-108106 osv.dev
• Ubuntu security notice ubuntu.com
• GitLab advisory advisories.gitlab.com
• VulnCheck advisory www.vulncheck.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:08.