Double free in snappy-java - CVE-2026-108104
Published: October 5, 2026 / Updated: October 13, 2026
Vulnerability identifier: #VU153264
CSH Severity: High
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-108104
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose and modify decompressed data from another stream.
The vulnerability exists due to a double free in SnappyFramedInputStream when allocating larger buffers for a declared chunk length. A remote attacker can cause an allocation failure after pooled buffers have been released to cause buffers to be shared across streams.
The default CachingBufferPool does not detect duplicate buffer releases.
Affected software
snappy-java
Tivoli Network Manager IP Edition
Tivoli Network Manager IP Edition
How to mitigate CVE-2026-108104
Install security update from vendor's website.
snappy-java - update to 1.1.10.10