CVE-2026-108106

Summary

The vulnerability allows attackers to cause unbounded memory allocation in snappy-java by crafting compressed data with large uncompressed lengths, leading to OutOfMemoryError and denial of service. This affects applications using Snappy compression libraries.

Exploitability

Exploitation is relatively straightforward as it requires only a few crafted bytes to trigger the vulnerability through Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream functions.

Blast radius

The impact could be significant across applications that use snappy-java for decompressing data, potentially causing widespread service disruption if exploited in high-volume systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to snappy-java 1.1.10.9 or later to address the unbounded memory allocation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.