CVE-2026-108104

EUVD-2026-95806
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.8 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.93%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
xerialsnappy-java
1.1.7.4 ≤
𝑥
< 1.1.10.10
CNA
Debian logo
Debian Releases
Debian Product
Codename
snappy-java
bookworm
vulnerable
forky
vulnerable
sid
vulnerable
trixie
vulnerable
Common Weakness Enumeration
References
https://github.com/xerial/snappy-java
https://github.com/xerial/snappy-java/blob/v1.1.10.9/src/main/java/org/xerial/snappy/SnappyFramedInputStream.java#L243
https://github.com/xerial/snappy-java/commit/139a53090a6662298924fd75d21f4769b4a219ea
https://github.com/xerial/snappy-java/releases/tag/v1.1.10.10
https://github.com/xerial/snappy-java/security/advisories/GHSA-c73m-r934-8qvg
https://www.vulncheck.com/advisories/xerial-snappy-java-1.1.7.4-before-1.1.10.10-double-release-of-pooled-buffers-in-snappyframedinputstream