PT-2026-108936 · Pypi · Snappy-Java
CVE-2026-108104
·
Published
2026-10-09
·
Updated
2026-10-09
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
xerial snappy-java versions 1.1.7.4 through 1.1.10.9
Description
A double release issue exists in the
SnappyFramedInputStream class. This occurs when replacement allocation fails, leading to pooled buffers being returned twice. An attacker can trigger an OutOfMemoryError by providing framed data with a large declared chunk length. This results in shared backing arrays that may expose or overwrite decompressed data from other streams.Recommendations
Update xerial snappy-java to version 1.1.10.10.
Exploit
Fix
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Snappy-Java