snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

影響: maven:org.xerial.snappy:snappy-java <= 1.1.10.8 → 1.1.10.9

Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing OutOfMemoryError (denial of service), or a NegativeArraySizeException for declared lengths of 2^31 or more. Affected entry points include Snappy.uncompress(byte[]), Snappy.uncompressString, the Snappy.uncompressArray met…

Read on GitHub Advisory Database

On 10/28/2026, 12:33 AM, GitHub Advisory Database published "snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha" (type: Advisory). Severity is "High" (high). Related technologies: Java. CVE: CVE-2026-108106.