The vulnerability stems from an unbounded array allocation performed by the FuryUtil.deserialize helper in SnailJob version 1.7.0. A crafted Zstandard payload with an inflated frame_content_size field in the frame header can be supplied by an authenticated user. When such a payload is stored as a base64‑encoded retry task argument, the JVM attempts to allocate an arbitrarily large array and fails with java.lang.OutOfMemoryError, causing the server process to crash. This is a classic CWE‑789 use‑of‑unbounded‑size data where the attacker can force a denial of service. The impact is a disruption of service; it does not compromise confidentiality or integrity.

The affected product is SnailJob 1.7.0 from the aizuda:SnailJob (snail-job) vendor. This specific version contains the vulnerability described. A newer release, v2.0.0, is available and includes patches that mitigate the risk, as referenced in the vendor’s releases page.

The CVSS score of 7.1 indicates a high severity level. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and able to submit retry tasks, which limits the pool of potential attackers to users with legitimate access to the system. Nevertheless, once such an attacker submits a malicious payload, the unbounded array allocation will trigger a fatal OutOfMemoryError, leading to an immediate service outage. The exploit path is straightforward and does not require advanced techniques beyond constructing a Zstandard payload with an inflated size field.