SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causing the JVM to attempt an unbounded array allocation and triggering an unrecoverable java.lang.OutOfMemoryError when the task is dispatched through the retry-task pipeline.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Aizuda |
|
No data.
No data.
References
History
Wed, 05 Aug 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Aizuda
Aizuda snailjob (snail-job) |
|
| Vendors & Products |
Aizuda
Aizuda snailjob (snail-job) |
Tue, 04 Aug 2026 18:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causing the JVM to attempt an unbounded array allocation and triggering an unrecoverable java.lang.OutOfMemoryError when the task is dispatched through the retry-task pipeline. | |
| Title | SnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOM | |
| Weaknesses | CWE-789 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published: 2026-08-04T17:45:32.506Z
Updated: 2026-08-04T17:45:32.506Z
Reserved: 2026-08-03T21:33:22.018Z
Link: CVE-2026-69702
Vulnrichment
No data.
NVD
No data.
Redhat
No data.