CVE-2026-108106High· 7.5▾ TwilightXerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes t…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
org.xerial.snappy:snappy-java <= 1.1.10.8Patched in:
org.xerial.snappy:snappy-java 1.1.10.9Connected by shared product, vendor, weakness, or advisory.
CVE-2026-96640High· 7.5pillow: pillow: Denial of Service via duplicate page references in PDF files (CVE-2026-96640)
CVE-2026-112915Medium· 5.5filelock: filelock: Denial of Service via crafted SQLite lock database (CVE-2026-112915)
CVE-2026-111066High· 7.5aiohttp: aiohttp: Denial of Service via file descriptor exhaustion in multipart request processing (CVE-2026-111066)
CVE-2026-111064High· 7.5aiohttp: aiohttp: Denial of Service via missing initial request timeout (CVE-2026-111064)
CVE-2026-68498High· 7.5com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via excessively long JSON propert…
CVE-2026-56816High· 7.5io.netty:netty-codec-http3: Netty: Denial of Service due to uncontrolled memory buffering in HTTP/3 (CVE-2026-56816)