EUVD-2026-52851
GHSA-ppxj-mvph-j9w4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable retry pipeline (AV:N), requires authenticated low-privilege session (PR:L), full availability loss from unrecoverable JVM OOM crash (A:H), no confidentiality or integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causing the JVM to attempt an unbounded array allocation and triggering an unrecoverable java.lang.OutOfMemoryError when the task is dispatched through the retry-task pipeline.
AnalysisAI
Denial of service in SnailJob 1.7.0 allows authenticated attackers to crash the JVM by exploiting the FuryUtil.deserialize helper's failure to validate the frame_content_size field in Zstandard-compressed frame headers before allocating memory. By storing a base64-encoded crafted payload with an arbitrarily inflated decompressed-size declaration in a retry task argument, an attacker causes an unbounded array allocation attempt when the task traverses the retry-task pipeline, resulting in an unrecoverable java.lang.OutOfMemoryError and full server crash. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; a vendor patch has been released as vsj2.0.0.
Technical ContextAI
SnailJob (aizuda/snail-job, CPE: cpe:2.3:a:aizuda:snailjob_(snail-job):*:*:*:*:*:*:*:*) is a Java-based distributed retry and task scheduling framework. The vulnerability resides in the FuryUtil.deserialize helper, which processes Zstandard (Zstd) compressed data used for serializing retry task arguments. The Zstandard frame format contains a frame header with an optional frame_content_size field that declares the decompressed size of the payload. CWE-789 (Uncontrolled Memory Allocation) captures the root cause: the deserializer trusts this attacker-controlled field and passes it directly to a JVM array allocation call without bounding or validating the declared size against a safe maximum. When the JVM attempts to allocate an array matching the declared multi-gigabyte or terabyte size, it exhausts heap space and throws an unrecoverable OutOfMemoryError. Because JVM OutOfMemoryError is not reliably catchable in all contexts, the process crashes rather than failing gracefully.
RemediationAI
Upgrade SnailJob to release vsj2.0.0 or later, which contains the vendor-released patch for this vulnerability; the release is available at https://gitee.com/aizuda/snail-job/releases#release-vsj2.0.0. If an immediate upgrade is not feasible, restrict authenticated access to the retry-task submission endpoints to trusted internal principals only, reducing the pool of accounts capable of supplying crafted payloads. Additionally, consider configuring JVM memory limits and out-of-memory handling (e.g., -XX:+HeapDumpOnOutOfMemoryError and a process supervisor with automatic restart) so that a triggered crash results in a clean, auditable restart rather than silent unavailability; note that this is a compensating control only and does not prevent the crash itself. Review audit logs for anomalous retry task submissions with large or malformed base64-encoded arguments as an indicator of exploitation attempts.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today