---
id: CVE-2026-108106
title: >-
  Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation
  vulnerability that allows attackers to exhaust JVM memory by declaring a large
  uncompressed length in compressed input
summary: >-
  Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation
  vulnerability that allows attackers to exhaust JVM memory by declaring a large
  uncompressed length in compressed input. Attackers can supply a few crafted
  bytes t…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-789
  - CWE-770
vendor: Red Hat
product: Red Hat OpenShift AI (RHOAI)
affected:
  - build_of_apache_camel_4_for_quarkus 3
  - build_of_apache_camel_for_spring_boot 4
  - build_of_apicurio_registry 3
  - build_of_debezium 3
  - build_of_quarkus
  - ceph_storage 7
  - ceph_storage 8
  - ceph_storage 9
  - fuse 7
  - jboss_enterprise_application_platform_expansion_pack
  - offline_knowledge_portal
  - openshift_ai_rhoai
published: '2026-10-09'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:19.130'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108106'
references:
  - url: 'https://github.com/xerial/snappy-java'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75
    label: disclosure@vulncheck.com
  - url: 'https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service
    label: disclosure@vulncheck.com
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-108106.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-108106'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2548629'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-108106'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108106'
  - url: 'https://github.com/xerial/snappy-java/pull/739'
  - url: 'https://github.com/advisories/GHSA-q233-g92q-qxp6'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
  - ghsa
  - maven
epss: 0.00371
epssPercentile: 0.30891
ingestedAt: '2026-10-09T16:02:33.384Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-13T16:50:47.015019Z'
aliases:
  - GHSA-q233-g92q-qxp6
ecosystem: maven
patched:
  - 'org.xerial.snappy:snappy-java 1.1.10.9'
---

## Overview

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat build of Apache Camel 4 for Quarkus 3, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3, Red Hat build of Debezium 3, Red Hat build of Quarkus, Red Hat Ceph Storage 7, … · no fix planned: Red Hat Fuse 7, Red Hat Ceph Storage 7, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-108106.json)

## Package advisory (CVE-2026-108106)

Affected packages:

- `org.xerial.snappy:snappy-java <= 1.1.10.8`

Patched in:

- `org.xerial.snappy:snappy-java 1.1.10.9`

Source: https://github.com/advisories/GHSA-q233-g92q-qxp6