CVE-2026-44302

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44302", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T17:39:31.113Z", "datePublished": "2026-05-12T21:33:07.206Z", "dateUpdated": "2026-05-18T15:10:25.995Z"}, "containers": {"cna": {"title": "Snappier: Infinite loop in SnappyStream decompression on malformed framed input", "problemTypes": [{"descriptions": [{"cweId": "CWE-835", "lang": "en", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx"}], "affected": [{"vendor": "brantburnett", "product": "Snappier", "versions": [{"version": "< 1.3.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T21:33:07.206Z"}, "descriptions": [{"lang": "en", "value": "Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1."}], "source": {"advisory": "GHSA-pggp-6c3x-2xmx", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-18T15:10:06.362303Z", "id": "CVE-2026-44302", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T15:10:25.995Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44302", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T15:10:06.362303Z"}}}], "references": [{"url": "https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-18T15:10:21.865Z"}}], "cna": {"title": "Snappier: Infinite loop in SnappyStream decompression on malformed framed input", "source": {"advisory": "GHSA-pggp-6c3x-2xmx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "brantburnett", "product": "Snappier", "versions": [{"status": "affected", "version": "< 1.3.1"}]}], "references": [{"url": "https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx", "name": "https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-835", "description": "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-12T21:33:07.206Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44302", "state": "PUBLISHED", "dateUpdated": "2026-05-18T15:10:25.995Z", "dateReserved": "2026-05-05T17:39:31.113Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-12T21:33:07.206Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Snappier", "vendor": "brantburnett", "versions": [{"status": "affected", "version": "< 1.3.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1."}, {"lang": "es", "value": "Snappier es una implementaci\u00f3n en C# de alto rendimiento del algoritmo de compresi\u00f3n Snappy. Antes de 1.3.1, Snappier.SnappyStream entra en un bucle infinito inatrapable al descomprimir un flujo Snappy de formato enmarcado malformado de tan solo 15 bytes. Esta vulnerabilidad est\u00e1 corregida en 1.3.1."}], "id": "CVE-2026-44302", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44302", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-18T15:10:06.362303Z", "version": "2.0.3"}}]}, "published": "2026-05-12T22:16:36.997", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Snappier", "source": "cna", "vendor": "brantburnett"}, "product": "snappier", "vendor": "brantburnett"}], "created": "2026-05-12T23:45:25.454520+00:00", "updated": "2026-05-13T10:35:24.678090+00:00", "vendors": ["brantburnett", "brantburnett$PRODUCT$snappier"]}