---
id: GHSA-94x4-5g3f-jjxp
title: >-
  Duplicate Advisory: snappy-java: Unbounded memory allocation from
  attacker-declared uncompressed lengtha
summary: >-
  Duplicate Advisory: snappy-java: Unbounded memory allocation from
  attacker-declared uncompressed lengtha
severity: high
cvss: 7.5
cwe:
  - CWE-789
vendor: xerial
product: 'org.xerial.snappy:snappy-java'
ecosystem: maven
affected:
  - 'org.xerial.snappy:snappy-java < 1.1.10.9'
published: '2026-10-09'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T15:33:19Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-94x4-5g3f-jjxp'
references:
  - url: >-
      https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108106'
  - url: >-
      https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75
  - url: 'https://github.com/xerial/snappy-java'
  - url: >-
      https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517
  - url: 'https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9'
  - url: >-
      https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service
  - url: 'https://github.com/advisories/GHSA-94x4-5g3f-jjxp'
tags:
  - ghsa
  - maven
ingestedAt: '2026-10-27T16:11:58.713Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-q233-g92q-qxp6. This link is maintained to preserve external references.

## Original Description
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.

## Affected packages

- `org.xerial.snappy:snappy-java < 1.1.10.9`

## Remediation

Refer to the advisory for the patched release.