Xerial Snappy Java Before 1.1.10.9 Unbounded Memory Allocation Denial Of Service

Back www.vulncheck.com

Xerial Snappy Java Before 1.1.10.9 Unbounded Memory Allocation Denial Of Service

www.vulncheck.com • October 9, 2026

Share: View original

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

High-Risk CVE-2026-108106 in Xerial Snappy Java Library Xerial snappy-java versions prior to 1.1.10.9 are vulnerable to an unbounded memory allocation flaw, identified as CVE-2026-108106, which can lead to denial of service by exhausting JVM memory. Attackers can exploit this vulnerability by supplying crafted input to various decoding functions, potentially causing OutOfMemoryError and service interruptions. The vulnerability poses a high availability risk, particularly for Java applications that decode Snappy data from untrusted sources. The current status indicates no confirmed exploitation in the wild, but the urgency for patching is emphasized. Users are advised to upgrade to the fixed version and implement strict input validation and resource limits until then. The CVSS score for this vulnerability is 8.7, categorizing it as high severity. 1 sources 63

Extracted Entities

Attack Types (1)

Denial of Service

CWE Weaknesses (1)

CWE-400 - Uncontrolled Resource Consumption

Vulnerabilities (1)

Unbounded Memory Allocation Denial Of Service