snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

影響: maven:org.xerial.snappy:snappy-java <= 1.1.10.8 → 1.1.10.9

Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing OutOfMemoryError (denial of service), or a NegativeArraySizeException for declared lengths of 2^31 or more. Affected entry points include Snappy.uncompress(byte[]), Snappy.uncompressString, the Snappy.uncompressArray met…

GitHub Advisory Databaseで読む

2026/10/28 00:33、GitHub Advisory Databaseが「snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Java。CVE: CVE-2026-108106。