Zero Radar
← feed
HighVulnerabilityCVE-2026-108106updated 27 Oct 2026, 15:33 UTC

snappy-java can be crashed by small crafted compressed data

A tiny specially crafted compressed input can make a Java program try to reserve up to 2 GB of memory, which can crash it. Only programs that decompress data from untrusted sources are at risk.

Fixed in 1.1.10.9Official source
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes1.1.10.9 · since 27 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Crafted inputFew bytes declaring a huge length
  2. 2App decompressesCalls Snappy.uncompress or stream reader
  3. 3Large allocationBuffer sized from declared length
  4. 4Service failsOutOfMemoryError or exception
  5. ResultService crashes from memory exhaustion

What happened

In snappy-java, several decompression methods allocate an output buffer based on the uncompressed length declared in the first bytes of the input before validating it, enabling memory exhaustion and NegativeArraySizeException.

Why it is dangerous: A remote or unauthenticated sender can cause OutOfMemoryError or crashes (denial of service) in services that decompress untrusted Snappy data.

Are you affected?

You are affected if you use org.xerial.snappy:snappy-java version 1.1.10.8 or earlier and decompress data from untrusted sources.

Package / productAffected versionsFixed in
org.xerial.snappy:snappy-java · maven<= 1.1.10.81.1.10.9

What to do

  1. Update org.xerial.snappy:snappy-java to 1.1.10.9 or later
  2. If you cannot update yet, call Snappy.uncompressedLength(input) on untrusted data and reject inputs above an application-specific limit before decompressing

Timeline

  1. 27 Oct 2026, 15:33 UTC
    Publicly disclosed
  2. 27 Oct 2026, 15:33 UTC
    Reported by GitHub Advisory · GitHub Advisory
  3. 27 Oct 2026, 15:33 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-108106 · GHSA-q233-g92q-qxp6
CVSS
7.5 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 15:33 UTC
On Zero Radar
27 Oct 2026, 15:33 UTC (0 min after disclosure)
Last change
27 Oct 2026, 15:33 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

snappy-java can be crashed by small crafted compressed data · Zero Radar