CVE-2026-108106

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-108106", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-09T13:44:40.883Z", "datePublished": "2026-10-09T14:33:29.499Z", "dateUpdated": "2026-10-13T16:51:17.678Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-09T14:33:29.499Z"}, "datePublic": "2026-10-03T00:00:00.000Z", "title": "Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service", "descriptions": [{"lang": "en", "value": "Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Memory Allocation with Excessive Size Value", "cweId": "CWE-789", "type": "CWE"}]}], "affected": [{"vendor": "xerial", "product": "snappy-java", "defaultStatus": "unaffected", "packageURL": "pkg:maven/org.xerial.snappy/snappy-java", "versions": [{"version": "0", "status": "affected", "versionType": "custom", "lessThan": "1.1.10.9"}, {"version": "1.1.10.9", "status": "unaffected", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.1.10.9"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-q233-g92q-qxp6)"}, {"url": "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9", "tags": ["release-notes"], "name": "snappy-java v1.1.10.9 Release Notes"}, {"url": "https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517", "tags": ["technical-description"]}, {"url": "https://github.com/xerial/snappy-java", "tags": ["product"]}, {"name": "VulnCheck Advisory: Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service"}], "credits": [{"lang": "en", "value": "Yu Bao, PayPal Cyber Security Team", "type": "finder"}, {"lang": "en", "value": "1seal", "type": "finder"}, {"lang": "en", "value": "EndlssNightmare", "type": "finder"}, {"lang": "en", "value": "taer", "type": "finder"}, {"lang": "en", "value": "apvxlab", "type": "finder"}, {"lang": "en", "value": "trnguyencflt", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-13T16:50:47.015019Z", "id": "CVE-2026-108106", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T16:51:17.678Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-108106", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-13T16:50:47.015019Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-13T16:51:08.406Z"}}], "cna": {"title": "Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service", "credits": [{"lang": "en", "type": "finder", "value": "Yu Bao, PayPal Cyber Security Team"}, {"lang": "en", "type": "finder", "value": "1seal"}, {"lang": "en", "type": "finder", "value": "EndlssNightmare"}, {"lang": "en", "type": "finder", "value": "taer"}, {"lang": "en", "type": "finder", "value": "apvxlab"}, {"lang": "en", "type": "finder", "value": "trnguyencflt"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "xerial", "product": "snappy-java", "versions": [{"status": "affected", "version": "0", "lessThan": "1.1.10.9", "versionType": "custom"}, {"status": "unaffected", "version": "1.1.10.9", "versionType": "custom"}], "packageURL": "pkg:maven/org.xerial.snappy/snappy-java", "defaultStatus": "unaffected"}], "datePublic": "2026-10-03T00:00:00.000Z", "references": [{"url": "https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6", "name": "GitHub Security Advisory (GHSA-q233-g92q-qxp6)", "tags": ["vendor-advisory"]}, {"url": "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9", "name": "snappy-java v1.1.10.9 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517", "tags": ["technical-description"]}, {"url": "https://github.com/xerial/snappy-java", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service", "name": "VulnCheck Advisory: Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "Memory Allocation with Excessive Size Value"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:xerial:snappy-java:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.1.10.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-09T14:33:29.499Z"}}}, "cveMetadata": {"cveId": "CVE-2026-108106", "state": "PUBLISHED", "dateUpdated": "2026-10-13T16:51:17.678Z", "dateReserved": "2026-10-09T13:44:40.883Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-10-09T14:33:29.499Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:maven/org.xerial.snappy/snappy-java", "product": "snappy-java", "vendor": "xerial", "versions": [{"lessThan": "1.1.10.9", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "1.1.10.9", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service."}], "id": "CVE-2026-108106", "lastModified": "2026-10-13T17:17:19.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-108106", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-13T16:50:47.015019Z", "version": "2.0.3"}}]}, "published": "2026-10-09T15:17:11.550", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/xerial/snappy-java"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "org.xerial.snappy/snappy-java: snappy-java: Denial of Service via unbounded memory allocation during decompression", "id": "2548629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548629"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in snappy-java. A remote attacker can exploit this unbounded memory allocation vulnerability by providing crafted compressed input with an excessively large declared uncompressed size during decompression. Successful exploitation allows the attacker to exhaust available system memory, leading to an OutOfMemoryError and causing a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-108106", "package_state": [{"cpe": "cpe:/a:redhat:camel_quarkus:3", "fix_state": "Affected", "package_name": "snappy-java", "product_name": "Red Hat build of Apache Camel 4 for Quarkus 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "snappy-java", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Affected", "package_name": "snappy-java", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Affected", "package_name": "snappy-java", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:quarkus:3", "fix_state": "Affected", "package_name": "snappy-java", "product_name": "Red Hat build of Quarkus"}, {"cpe": "cpe:/a:redhat:ceph_storage:7", "fix_state": "Fix deferred", "package_name": "liborc", "product_name": "Red Hat Ceph Storage 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "liborc", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Fix deferred", "package_name": "liborc", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "snappy-java", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "snappy-java", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Affected", "package_name": "snappy-java", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Affected", "package_name": "offline-knowledge-portal/rhokp-rhel9", "product_name": "Red Hat Offline Knowledge Portal"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-spark-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-10-09T14:33:29Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-108106\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-108106\nhttps://github.com/xerial/snappy-java\nhttps://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517\nhttps://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75\nhttps://github.com/xerial/snappy-java/releases/tag/v1.1.10.9\nhttps://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6\nhttps://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service"], "statement": "This vulnerability is rated as Important because remote unauthenticated attackers can trigger application crashes across services parsing untrusted compressed streams, leading to a complete denial of service for host Java applications. In Red Hat environments, snappy-java is utilized as a compression library in various middleware and data-processing workloads. Exploitation requires the vulnerable component to decompress user-supplied inputs, meaning deployments that do not ingest untrusted compressed payloads or that restrict input processing at service boundaries experience reduced exposure.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.10.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.1.10.9"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "snappy-java", "source": "cna", "vendor": "xerial"}, "product": "snappy-java", "vendor": "xerial"}], "created": "2026-10-09T15:30:08.215817+00:00", "updated": "2026-10-10T02:30:05.689224+00:00", "vendors": ["xerial", "xerial$PRODUCT$snappy-java"]}