SB2026100532 - Multiple vulnerabilities in snappy-java
Published: October 5, 2026 Updated: October 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Uncontrolled Recursion (CVE-ID: N/A)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in SnappyInputStream when processing concatenated data containing a long sequence of stream headers. A remote attacker can provide specially crafted concatenated input to cause a denial of service.
2) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the compressed chunk buffer of SnappyInputStream when processing a truncated stream containing a crafted chunk header. A remote attacker can provide specially crafted truncated input to cause a denial of service.
3) Double free (CVE-ID: CVE-2026-108104)
CWE-ID: CWE-415 - Double Free
CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose and modify decompressed data from another stream.
The vulnerability exists due to a double free in SnappyFramedInputStream when allocating larger buffers for a declared chunk length. A remote attacker can cause an allocation failure after pooled buffers have been released to cause buffers to be shared across streams.
The default CachingBufferPool does not detect duplicate buffer releases.
Remediation
Install update from vendor's website.