CVE-2026-108106

About vulnerability

Impact

Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing OutOfMemoryError (denial of service), or a NegativeArraySizeException for declared lengths of 2^31 or more.

Affected entry points include Snappy.uncompress(byte[]), Snappy.uncompressString, the Snappy.uncompress*Array methods, SnappyInputStream, and SnappyFramedInputStream. The maxChunkSize limit added for CVE-2023-43642 bounds only the compressed chunk length, so it does not prevent this.

Patches

Fixed in 1.1.10.9 (#739). Snappy.uncompressedLength() now rejects negative declared lengths, and lengths larger than any valid Snappy stream of the given size can produce. The densest Snappy element expands 3 bytes to 64, so the limit is 64/3 of the compressed size. Allocations are therefore proportional to the input actually received.

Workarounds

Before decompressing untrusted data, check that Snappy.uncompressedLength(input) is within an application-specific limit.

Affected product:

Apache CXF , Apache Hadoop , Apache Hive , Apache Kafka , Apache Log4j , Apache Solr , Apache Spark , Elasticsearch , Hazelcast , Jackson , React , Spring , accumulo , activemq , agepredictor , alluxio , amazon-kinesis-client , amazon-kinesis-producer , apicurio-registry , arrow , artemis , astyanax , avro , aws-glue-schema-registry , bookkeeper , camel , canal , chronicle-engine , chronicle-map , crunch , curator , debezium , drill , dropwizard-metrics-hadoop-metrics2-reporter , druid , flink , flume , fuse-extra , glusterfs-hadoop , gora , hbase , ignite , incubator-retired-htrace , incubator-retired-slider , infinispan , java-lang , kite , logging-flume , logging-flume-irc , orc , org.apache.cassandra:cassandra-all , org.apache.parquet:parquet-cli , org.kitesdk:kite-data-hbase , org.tachyonproject:tachyon-client , parquet-java , pig , pravega , pulsar , rabbitmq-stream-java-client , schema-repo , servicemix-bundles , smallrye-mutiny-vertx-bindings , smallrye-reactive-messaging , snappy-java , tachyon , tika , tinkerpop , trino , twill , vertx-kafka-client , zipkin-reporter-java , zookeeper

Affected packages:

snappy-java @ 1.1.8.4 (+10529 more)