Snailjob Snail Job
Monthly
Denial of service in SnailJob 1.7.0 allows authenticated attackers to crash the JVM by exploiting the FuryUtil.deserialize helper's failure to validate the frame_content_size field in Zstandard-compressed frame headers before allocating memory. By storing a base64-encoded crafted payload with an arbitrarily inflated decompressed-size declaration in a retry task argument, an attacker causes an unbounded array allocation attempt when the task traverses the retry-task pipeline, resulting in an unrecoverable java.lang.OutOfMemoryError and full server crash. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; a vendor patch has been released as vsj2.0.0.
Denial of service in SnailJob 1.7.0 allows authenticated attackers to crash the JVM by exploiting the FuryUtil.deserialize helper's failure to validate the frame_content_size field in Zstandard-compressed frame headers before allocating memory. By storing a base64-encoded crafted payload with an arbitrarily inflated decompressed-size declaration in a retry task argument, an attacker causes an unbounded array allocation attempt when the task traverses the retry-task pipeline, resulting in an unrecoverable java.lang.OutOfMemoryError and full server crash. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; a vendor patch has been released as vsj2.0.0.