CVE-2026-108106— Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Quick assessment
Affected
xerial snappy-java
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Xerial snappy-java 在 1.1.10.9 版本之前存在一个无界内存分配漏洞，攻击者通过在压缩输入中声明一个很大的未压缩长度，可以耗尽 JVM 内存。攻击者可以向 Snappy.uncompress、uncompressString、SnappyInputStream 或 SnappyFramedInputStream 提供几个精心构造的字节，以强制分配高达 2GB 的内存，从而导致 OutOfMemoryError 并引发拒绝服务攻击。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108106
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的内存分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| xerial | snappy-java | 0 ~ 1.1.10.9 | - |
|
II. Public POCs for CVE-2026-108106
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108106
请登录查看更多情报信息。
Proof of Concept for CVE-2026-108106 (1)
Other References for CVE-2026-108106 (5)
IV. Related Vulnerabilities
Same product: snappy-java
-
CVE-2026-108104
Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release o -
CVE-2026-93451
snappy-java through 1.1.10.8 Buffer Overflow via typed uncom -
CVE-2026-93452
snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compr -
CVE-2026-90559
snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompr -
CVE-2023-43642
Missing upper bound check on chunk length in snappy-java
Same vendor: xerial
-
CVE-2026-108104
Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release o -
CVE-2026-93452
snappy-java through 1.1.10.8 Buffer Overflow in Snappy.compr -
CVE-2026-93451
snappy-java through 1.1.10.8 Buffer Overflow via typed uncom -
CVE-2026-90559
snappy-java through 1.1.10.8 Out-of-Bounds Write via uncompr -
CVE-2023-43642
Missing upper bound check on chunk length in snappy-java
Same weakness: CWE-789
-
CVE-2026-107390
music-metadata: MP4 parser allows memory exhaustion via over -
CVE-2026-107389
music-metadata: EBML parser trusts element lengths, allowing -
CVE-2026-107388
music-metadata: ID3v2 tag size not validated before allocati -
CVE-2026-107387
music-metadata: Uncontrolled memory allocation in APEv2 pars -
CVE-2026-107223
Excelize: Unbounded <col max> attribute is loaded with no Ma
V. Comments for CVE-2026-108106
No comments yet