The vulnerability is an unbounded memory allocation in Xerial snappy-java that occurs when the library uncompresses data. A crafted input can declare an extremely large uncompressed length, causing Snappy.uncompress, Snappy.uncompressString, or the stream classes to allocate up to 2 GB of RAM. This triggers an OutOfMemoryError, which aborts the Java Virtual Machine and results in denial of service to any running application. The weakness is a classic over‑allocating flaw and maps to CWE‑770 (Uncontrolled Resource Consumption) and CWE‑789 (Uncontrolled Memory Allocation).

Affected versions of the library start with the upstream release v1.1.10.9; any installation of xerial snappy-java older than 1.1.10.9, such as 1.1.10.8 and earlier, is vulnerable. The issue applies to all builds that use the default uncompress implementations in the public API.

The CVSS score of 8.7 indicates high severity. The EPSS score is not available, suggesting limited public exploitation data, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can trigger the flaw by providing malicious compressed data; if the functions are invoked on data received from a remote client, the attack vector is inferred to be remote, otherwise the vector remains local. Exploitation forces a 2 GB allocation, causing the process to terminate and denying service to dependent components.