{"id":"CVE-2026-69702","published":"2026-08-04T19:16:53.980","lastModified":"2026-08-05T20:17:14.820","description":"SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causing the JVM to attempt an unbounded array allocation and triggering an unrecoverable java.lang.OutOfMemoryError when the task is dispatched through the retry-task pipeline.","cvssScore":6.5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-789"],"vendors":[],"products":[],"references":[{"url":"https://gitee.com/aizuda/snail-job","tags":[]},{"url":"https://gitee.com/aizuda/snail-job/issues/ICRJMI","tags":[]},{"url":"https://gitee.com/aizuda/snail-job/releases#release-vsj2.0.0","tags":[]},{"url":"https://www.vulncheck.com/advisories/snailjob-denial-of-service-via-furyutil-deserialize-oom","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows authenticated attackers to crash SnailJob 1.7.0 servers by sending a specially crafted payload, leading to an OutOfMemoryError due to unbounded array allocation.","exploitability":"Exploitation requires authentication and knowledge of the Zstandard compression format; moderately difficult.","blast_radius":"If exploited, it could result in server downtime affecting service availability for legitimate users.","remediation":"Upgrade to a patched version or disable retry tasks until a fix is available.","tags":["dos","auth-required","java"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T07:06:03.346Z"}}