## snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

- 種別: advisory
- 重大度: high
- 関連技術: java
- CVE: CVE-2026-108106
- 公開日時: 2026-10-27T15:33:22.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-q233-g92q-qxp6)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-q233-g92q-qxp6

影響: maven:org.xerial.snappy:snappy-java <= 1.1.10.8 → 1.1.10.9
Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing OutOfMemoryError (denial of service), or a NegativeArraySizeException for declared lengths of 2^31 or more. Affected entry points include Snappy.uncompress(byte[]), Snappy.uncompressString, the Snappy.uncompressArray met…