CVE-2026-108106

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108106
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108106.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108106
Aliases
Downstream
CGA (410)
CLEANSTART (2)
DEBIAN (1)
ECHO (1)
UBUNTU (1)
Published
2026-10-09T14:33:29Z
Modified
2026-10-28T11:06:13Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Details

Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-789"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108106.json"
}
References

Affected packages

Git / github.com/xerial/snappy-java

Affected ranges

Type
GIT
Repo
https://github.com/xerial/snappy-java
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eb3cfbdbc449964f7b969f3bd1085fb93f64634a
Fixed
943c6043a292568575e8347af4507d015e802c75
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "1.1.10.9"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "943c6043a292568575e8347af4507d015e802c75"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.1.10.9",
            "range":  [
                {
                    "fixed":  "eb3cfbdbc449964f7b969f3bd1085fb93f64634a"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

1.*
1.0.5-M4
1.1.0
1.1.0-M1
1.1.0-M3
1.1.2.5
1.1.3-M1
1.1.3-M2
1.1.4
1.1.4-M1
1.1.4-M2
1.1.4-M3
1.1.7
1.1.7.1
1.1.7.2
1.1.7.3
1.1.7.4
1.1.7.5
1.1.7.6
1.1.7.7
1.1.7.8
1.1.8
1.1.8.1
1.1.8.2
1.1.8.3
1.1.8.4
snappy-java-1.*
snappy-java-1.0.1-rc1
snappy-java-1.0.1-rc2
snappy-java-1.0.1-rc3
snappy-java-1.0.1-rc4
snappy-java-1.0.3
snappy-java-1.0.3-rc1
snappy-java-1.0.3-rc2
snappy-java-1.0.3-rc3
snappy-java-1.0.3-rc4
snappy-java-1.0.3.1
snappy-java-1.0.3.2
snappy-java-1.0.3.3
snappy-java-1.0.4
snappy-java-1.0.4.1
v1.*
v1.1.10.0
v1.1.10.1
v1.1.10.2
v1.1.10.3
v1.1.10.4
v1.1.10.5
v1.1.10.6
v1.1.10.7
v1.1.10.8
v1.1.9.0
v1.1.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108106.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "248548812129249835623685386102701344610",
            "length":  564
        },
        "id":  "CVE-2026-108106-0365092d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "compress"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "993983935673715819417586430422796197",
            "length":  264
        },
        "id":  "CVE-2026-108106-177ef382",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompressedLength"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "225550944486603663892110309051932282193",
            "length":  198
        },
        "id":  "CVE-2026-108106-2f06bb25",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "isValidCompressedBuffer"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "268924270988351615666073501984659179704",
            "length":  269
        },
        "id":  "CVE-2026-108106-38fcf167",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "rawUncompress"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "137819023510453680586950144257798487614",
            "length":  550
        },
        "id":  "CVE-2026-108106-3eb3fc5f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompress"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "204555071193342404345625222467881815659",
                "10164829056455229625957050151459837224",
                "292665523758310622036659306988663961822",
                "31573189920166813682653946966367960842",
                "43889662972789450389594832729403056978",
                "153011782331190116629399831086624848201",
                "75402019964417829527871624554794561386",
                "229514560655059586231778561377303737840",
                "286937503022989868223168645306028543977",
                "145944924210506534905155725464426736577",
                "179398869102739865008853389278573659040",
                "82845434210337483416806858518177109413",
                "120329902475980098371257868546784419669",
                "334273375945011597877144162448265875289",
                "170297590394898638919926879300111402308"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108106-41301680",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/SnappyFramedInputStream.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "225550944486603663892110309051932282193",
            "length":  198
        },
        "id":  "CVE-2026-108106-4577e6f1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompressedLength"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "273233105182430909936087273050653208227",
                "243544406358732528115134969336766976760",
                "202581787381806436857075817812663553766",
                "337071137569324413841799637200410222249",
                "57835637789144906142286242078420847463",
                "128521763514813841228686126471544528461",
                "185772298371131891837049678477556142093",
                "329943129423076040183580411597781604273",
                "54847961552838994840200790813570501391",
                "206093361768349750107994365953242530368",
                "218078284978826677240987547389247109719",
                "230391350836850075867023503573529744803",
                "328219320706663266465074186481751610851",
                "623488373329341370982857639786878526",
                "320585331890031113620088136861356958435",
                "114139836660528492370632300360851426681",
                "138822543685107125046772563381027348184",
                "167019033014514495170431647277737947604",
                "249114828564353825279291145938274650408",
                "237856404698482659651637388426215471865",
                "292787142117874832612001868661471072370",
                "53615845467150146307648695631905055049",
                "241261634804753206047535447650544108448",
                "197874102068180063971932817485761846576",
                "11338281859686048252233148447046740062",
                "249114828564353825279291145938274650408",
                "19598117978447518120058546916026935158",
                "27852316556508359089382404513547484730",
                "70398511449993822734454770270835679853",
                "36255484771656459860960178061310091446",
                "247091697574608700415297306523046462084",
                "263962986992475347362657759966540451864",
                "158634335582788568429293180141015414024",
                "117722791246504084241915071189186896999",
                "289337144734536159120334805869314194502",
                "333912519840969933879514551739967690901",
                "123543391574380225455898719642457847159",
                "265268163249106215685419019027602996204",
                "209060011743774900796093718863988134513",
                "331408189595418564355311863766543017299",
                "315850159606424581868983747344983951783",
                "257943731297718711389340679661599389856",
                "29844900467661147266042534906186152537",
                "214065112366599025913311607397752097717",
                "193518507030979274575345214915463798547",
                "301003666945285247005164741673112788653",
                "216165231819697038243876988999484670415",
                "281444310091969721110876962891772851897",
                "315946045191089459384674921488917744117",
                "249768170815379096368409072557021289079",
                "329943129423076040183580411597781604273",
                "316606264207455949077502809951191860393",
                "94277009961356285949262467607645028515",
                "235433064448662058311414745900343676066",
                "165579981270362289138883878095905147922",
                "156086548689335677516315753097552755448",
                "113869536738177329892406659697188329075",
                "37321283913378068897837368453749747555",
                "334022062309863767886424853112953518210",
                "250051926075228956163094451311541705317",
                "279583926769940597697200876784578764960",
                "231591651012075897705710892097423744397",
                "166834763274860817085145746180619260821",
                "34638365479620446267997331737265954988",
                "137180813970385283643711056907511702516",
                "126149572654015820503636821268566921339",
                "129055938288033012122013245103126903835",
                "38159770725060011301619244826240394759",
                "279264140671924442324216888055083078006",
                "307601048980526603953146813846471720332",
                "304817394542572055562133277923782920543",
                "301937293703966716061270548360530109257",
                "69476595876174041651322893156357013283",
                "335352909114077310092727884570721723483",
                "57619516575135067704073380787810428440",
                "321033549599559355171761192567519546864",
                "317487508462920708920058945347947936408",
                "206906207199960837120774027554423945554",
                "307248188929643939046676278923601360695"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108106-480d2138",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "239172761404378588201118166677851524180",
            "length":  110
        },
        "id":  "CVE-2026-108106-522a5100",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompressedLength"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "166495027343670884745994773196278683886",
            "length":  109
        },
        "id":  "CVE-2026-108106-63b339b4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompressedLength"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "237526613212343554529431919722170183307",
            "length":  255
        },
        "id":  "CVE-2026-108106-64ba8fc9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompressLongArray"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "199724134906981878760698534768751703863",
            "length":  1660
        },
        "id":  "CVE-2026-108106-651c2f68",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/SnappyFramedInputStream.java",
            "function":  "ensureBuffer"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "237526613212343554529431919722170183307",
            "length":  255
        },
        "id":  "CVE-2026-108106-691d6a4a",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompressDoubleArray"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "23053188914608360963453623850728662946",
            "length":  284
        },
        "id":  "CVE-2026-108106-88860fd1",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "rawCompress"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "312451687875802634140021153524818815869",
            "length":  252
        },
        "id":  "CVE-2026-108106-bdd1d1e3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompressIntArray"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "293005533203826661541217399927873573495",
            "length":  287
        },
        "id":  "CVE-2026-108106-c4467f15",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "rawCompress"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "317197619888358687596706558361166686775",
            "length":  255
        },
        "id":  "CVE-2026-108106-c885794d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompressShortArray"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "33751945188057511458210140342084703118",
            "length":  255
        },
        "id":  "CVE-2026-108106-d501738d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompressFloatArray"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "317197619888358687596706558361166686775",
            "length":  255
        },
        "id":  "CVE-2026-108106-e1d85dea",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75",
        "target":  {
            "file":  "src/main/java/org/xerial/snappy/Snappy.java",
            "function":  "uncompressCharArray"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:06:13Z"