Bug#1150498: snappy-java: CVE-2026-108104

[Salvatore Bonaccorso]

Source: snappy-java
Version: 1.1.10.8-1
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for snappy-java.

CVE-2026-108104[0]:
| Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double
| release vulnerability in SnappyFramedInputStream that returns pooled
| buffers twice when replacement allocation fails. Attackers can
| supply framed data with a large declared chunk length to trigger
| OutOfMemoryError, causing shared backing arrays that expose or
| overwrite other streams' decompressed data.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-108104
    https://www.cve.org/CVERecord?id=CVE-2026-108104
[1] https://github.com/xerial/snappy-java/security/advisories/GHSA-c73m-r934-8qvg
[2] https://github.com/xerial/snappy-java/commit/139a53090a6662298924fd75d21f4769b4a219ea

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore