Bug 2548628 (CVE-2026-108104)

Summary: CVE-2026-108104 org.xerial.snappy/snappy-java: snappy-java: information disclosure via double release of pooled buffers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, ant, anujha, aoconnor, asoldano, asyoung, bbaranow, bmaxwell, bniver, bstansbe, ccranfor, cescoffi, cmah, dlofthou, ewittman, flucifre, fmariani, fmongiar, gmalinko, gmeno, groman, gsmet, gtanzill, istudens, ivassile, iweiss, janstey, jbuscemi, jhollowa, jmartisk, jnethert, jpechane, jwon, kaycoth, manderse, mbenjamin, mcarlett, mhackett, mosmerov, msvehla, nipatil, nwallace, olubyans, ozzy, pantinor, pberan, pdelbell, pesilva, pjindal, pmackay, prichard, rguimara, rhel-process-autobot, rkubis, rstancel, rstepani, sbiarozk, sostapov, sthirugn, tcunning, thjenkin, varjain, vdosoudi, vereddy, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in snappy-java. A remote attacker can cause information disclosure or data corruption by supplying framed data with an excessively large chunk length. This input triggers an out-of-memory condition during buffer reallocation in SnappyFramedInputStream, causing pooled memory buffers to be released multiple times. Consequently, different data streams may share the same memory buffer, allowing sensitive decompressed data to be exposed or overwritten.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2549461    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-09 14:52:42 UTC 
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to trigger OutOfMemoryError, causing shared backing arrays that expose or overwrite other streams' decompressed data.