CVE-2026-108104: Xerial Snappy-Java

Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.

Affected products

• Xerial Snappy-Java: from 1.1.7.4, before 1.1.10.10 (fixed in 1.1.10.10)

Published 2026-10-09. Last modified 2026-10-09.