Snappier, a high-performance C# implementation of the Snappy compression algorithm, contains a flaw in SnappyStream that causes an uncatchable infinite loop when decompressing a malformed framed-format stream as small as 15 bytes. The loop consumes CPU and memory until the process or system becomes unresponsive, resulting in a denial‑of‑service condition for the application that processes the data.

The vulnerability affects versions of the Snappier library released before 1.3.1, distributed under the brantburnett:Snappier vendor. Any project that references Snappier.SnappyStream without upgrading to 1.3.1 or later is at risk.

With a CVSS score of 7.5, the flaw is considered high severity. The EPSS score is not available, so the probability of exploitation in the wild is unknown, yet the issue is not listed in the CISA KEV catalog. An attacker could send or supply a carefully crafted, malformed Snappy stream to the vulnerable application, triggering the infinite loop. The attack requires no special privileges and can be performed remotely if the application accepts external compressed data. Successful exploitation results in process or system denial of service.