CVE-2026-108106

What it actually does

Unbounded memory allocation in decompression routines allows a small crafted input to trigger allocation of up to 2 GB, exhausting JVM heap and triggering OutOfMemoryError.

Why it matters to the business

Applications using the library become unavailable when an attacker sends a few bytes that force the JVM to crash, disrupting services that depend on this compression component.

How an attack unfolds

An attacker identifies an entry point that calls Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream, supplies a minimal payload declaring an extremely large uncompressed length, and causes the JVM to allocate far more memory than available, resulting in denial of service.

How to fix it

Upgrade snappy-java to version 1.1.10.9 or later; rebuild and redeploy all dependent artifacts; verify the updated library is loaded at runtime.

How to confirm the fix worked

Confirm the snappy-java JAR version is at least 1.1.10.9; run a test case that supplies the malicious length field and verify the call now fails fast instead of allocating excessive memory.

Typical attack path

1. Locate any network or file input that reaches a Snappy decompression method
2. Craft a compressed buffer containing a large declared uncompressed size but minimal actual data
3. Submit the buffer to Snappy.uncompress or equivalent stream constructors
4. Observe JVM heap exhaustion and application termination

How to detect it

Search application and JVM logs for OutOfMemoryError exceptions occurring shortly after calls to Snappy decompression methods; inspect thread dumps for large byte-array allocations originating from the snappy-java package.

• OutOfMemoryError.*snappy
• Snappy.uncompress
• SnappyInputStream
• SnappyFramedInputStream

What your security team should do

• Immediately update snappy-java to 1.1.10.9+ across all builds and containers
• Add dependency scanning to block future vulnerable versions of the library
• Monitor JVM heap metrics and alert on sudden spikes correlated with Snappy usage
• Review any custom code paths that directly invoke Snappy decompression on untrusted input