{"id":"GHSA-94x4-5g3f-jjxp","title":"Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha","summary":"Duplicate Advisory: snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha","severity":"high","cvss":7.5,"cwe":["CWE-789"],"vendor":"xerial","product":"org.xerial.snappy:snappy-java","ecosystem":"maven","affected":["org.xerial.snappy:snappy-java < 1.1.10.9"],"published":"2026-10-09","updated":"2026-10-27","sourceUpdated":"2026-10-27T15:33:19Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-94x4-5g3f-jjxp","references":[{"url":"https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108106"},{"url":"https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75"},{"url":"https://github.com/xerial/snappy-java"},{"url":"https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517"},{"url":"https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9"},{"url":"https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service"},{"url":"https://github.com/advisories/GHSA-94x4-5g3f-jjxp"}],"tags":["ghsa","maven"],"ingestedAt":"2026-10-27T16:11:58.713Z","slug":"GHSA-94x4-5g3f-jjxp","body":"## Overview\n\n## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-q233-g92q-qxp6. This link is maintained to preserve external references.\n\n## Original Description\nXerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.\n\n## Affected packages\n\n- `org.xerial.snappy:snappy-java < 1.1.10.9`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}