Threat Intelligence Database

CVE-2026-108106 is a high-severity vulnerability in xerial snappy-java before version 1.1.10.9. It involves unbounded memory allocation triggered by attackers supplying crafted compressed input with a large uncompressed length. This can cause the Java Virtual Machine (JVM) to allocate up to 2 GB of memory, leading to OutOfMemoryError and denial of service conditions.

A double free vulnerability exists in xerial snappy-java versions from 1.1.7.4 up to but not including 1.1.10.10. The flaw occurs in SnappyFramedInputStream when replacement allocation fails, causing pooled buffers to be released twice. This can lead to OutOfMemoryError and potentially expose or overwrite decompressed data from other streams.

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of the destination buffer. Attackers can supply incompressible data that exceeds the destination buffer's remaining capacity, corrupting off-heap memory and causing JVM termination.

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.

snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination buffer capacity is never validated against decompressed size. Attackers can supply valid compressed data that decompresses larger than the destination buffer, causing writes past buffer boundaries and JVM termination.