Source: snappy-java Version: 1.1.10.8-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for snappy-java. CVE-2026-108104[0]: | Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double | release vulnerability in SnappyFramedInputStream that returns pooled | buffers twice when replacement allocation fails. Attackers can | supply framed data with a large declared chunk length to trigger | OutOfMemoryError, causing shared backing arrays that expose or | overwrite other streams' decompressed data. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-108104 https://www.cve.org/CVERecord?id=CVE-2026-108104 [1] https://github.com/xerial/snappy-java/security/advisories/GHSA-c73m-r934-8qvg [2] https://github.com/xerial/snappy-java/commit/139a53090a6662298924fd75d21f4769b4a219ea Please adjust the affected versions in the BTS as needed. Regards, Salvatore
