snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha

影響: maven:org.xerial.snappy:snappy-java <= 1.1.10.8 → 1.1.10.9

Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing OutOfMemoryError (denial of service), or a NegativeArraySizeException for declared lengths of 2^31 or more. Affected entry points include Snappy.uncompress(byte[]), Snappy.uncompressString, the Snappy.uncompressArray met…

在 GitHub Advisory Database 阅读

2026/10/28 00:33，GitHub Advisory Database 发布了“snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Java。CVE：CVE-2026-108106。