snappy-java: Unbounded memory allocation from attacker-declared uncompressed lengtha
The advisory, in context
Impact
Several decompression paths in snappy-java allocate an output buffer sized by the uncompressed length declared in the first bytes of the compressed data, before decompressing or validating it. A few bytes of crafted input can therefore force an allocation of up to 2 GB, causing OutOfMemoryError (denial of service), or a NegativeArraySizeException for declared lengths of 2^31 or more.
Affected entry points include Snappy.uncompress(byte[]), Snappy.uncompressString, the Snappy.uncompress*Array methods, SnappyInputStream, and SnappyFramedInputStream. The maxChunkSize limit added for CVE-2023-43642 bounds only the compressed chunk length, so it does not prevent this.
Patches
Fixed in 1.1.10.9 (#739). Snappy.uncompressedLength() now rejects negative declared lengths, and lengths larger than any valid Snappy stream of the given size can produce. The densest Snappy element expands 3 bytes to 64, so the limit is 64/3 of the compressed size. Allocations are therefore proportional to the input actually received.
Workarounds
Before decompressing untrusted data, check that Snappy.uncompressedLength(input) is within an application-specific limit.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 1.1.10.9
Fixed in 1.1.10.9
83 explicitly affected versions
1.0.1-rc1, 1.0.1-rc2, 1.0.1-rc3, 1.0.1-rc4, 1.0.3, 1.0.3-rc1, 1.0.3-rc2, 1.0.3-rc3, 1.0.3-rc4, 1.0.3.1, 1.0.3.2, 1.0.3.3, 1.0.4, 1.0.4.1, 1.0.5, 1.0.5-M1, 1.0.5-M2, 1.0.5-M3, 1.0.5-M4, 1.0.5.1, 1.0.5.2, 1.0.5.3, 1.0.5.4, 1.1.0, 1.1.0-M1, 1.1.0-M2, 1.1.0-M3, 1.1.0-M4, 1.1.0.1, 1.1.1, 1.1.1-M1, 1.1.1-M2, 1.1.1-M3, 1.1.1-M4, 1.1.1.1, 1.1.1.2, 1.1.1.3, 1.1.1.4, 1.1.1.5, 1.1.1.6, 1.1.1.7, 1.1.10.0, 1.1.10.1, 1.1.10.2, 1.1.10.3, 1.1.10.4, 1.1.10.5, 1.1.10.6, 1.1.10.7, 1.1.10.8, 1.1.2, 1.1.2-M1, 1.1.2-RC1, 1.1.2-RC2, 1.1.2-RC3, 1.1.2.1, 1.1.2.2, 1.1.2.3, 1.1.2.4, 1.1.2.5, 1.1.2.6, 1.1.3-M1, 1.1.3-M2, 1.1.4, 1.1.4-M1, 1.1.4-M2, 1.1.4-M3, 1.1.7, 1.1.7.1, 1.1.7.2, 1.1.7.3, 1.1.7.4, 1.1.7.5, 1.1.7.6, 1.1.7.7, 1.1.7.8, 1.1.8, 1.1.8.1, 1.1.8.2, 1.1.8.3, 1.1.8.4, 1.1.9.0, 1.1.9.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.10.9"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.1-rc1",
"1.0.1-rc2",
"1.0.1-rc3",
"1.0.1-rc4",
"1.0.3",
"1.0.3-rc1",
"1.0.3-rc2",
"1.0.3-rc3",
"1.0.3-rc4",
"1.0.3.1",
"1.0.3.2",
"1.0.3.3",
"1.0.4",
"1.0.4.1",
"1.0.5",
"1.0.5-M1",
"1.0.5-M2",
"1.0.5-M3",
"1.0.5-M4",
"1.0.5.1",
"1.0.5.2",
"1.0.5.3",
"1.0.5.4",
"1.1.0",
"1.1.0-M1",
"1.1.0-M2",
"1.1.0-M3",
"1.1.0-M4",
"1.1.0.1",
"1.1.1",
"1.1.1-M1",
"1.1.1-M2",
"1.1.1-M3",
"1.1.1-M4",
"1.1.1.1",
"1.1.1.2",
"1.1.1.3",
"1.1.1.4",
"1.1.1.5",
"1.1.1.6",
"1.1.1.7",
"1.1.10.0",
"1.1.10.1",
"1.1.10.2",
"1.1.10.3",
"1.1.10.4",
"1.1.10.5",
"1.1.10.6",
"1.1.10.7",
"1.1.10.8",
"1.1.2",
"1.1.2-M1",
"1.1.2-RC1",
"1.1.2-RC2",
"1.1.2-RC3",
"1.1.2.1",
"1.1.2.2",
"1.1.2.3",
"1.1.2.4",
"1.1.2.5",
"1.1.2.6",
"1.1.3-M1",
"1.1.3-M2",
"1.1.4",
"1.1.4-M1",
"1.1.4-M2",
"1.1.4-M3",
"1.1.7",
"1.1.7.1",
"1.1.7.2",
"1.1.7.3",
"1.1.7.4",
"1.1.7.5",
"1.1.7.6",
"1.1.7.7",
"1.1.7.8",
"1.1.8",
"1.1.8.1",
"1.1.8.2",
"1.1.8.3",
"1.1.8.4",
"1.1.9.0",
"1.1.9.1"
]
}References
- https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6
- https://nvd.nist.gov/vuln/detail/CVE-2026-108106
- https://github.com/xerial/snappy-java/pull/739
- https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75
- https://github.com/xerial/snappy-java
- https://github.com/xerial/snappy-java/blob/v1.1.10.8/src/main/java/org/xerial/snappy/Snappy.java#L517
- https://github.com/xerial/snappy-java/releases/tag/v1.1.10.9
- https://www.vulncheck.com/advisories/xerial-snappy-java-before-1.1.10.9-unbounded-memory-allocation-denial-of-service