CVE-2026-44302

{"id": "CVE-2026-44302", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44302", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T15:10:06.362303Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "brantburnett", "product": "Snappier", "versions": [{"status": "affected", "version": "< 1.3.1"}]}]}], "published": "2026-05-12T22:16:36.997", "references": [{"url": "https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx", "source": "security-advisories@github.com"}, {"url": "https://github.com/brantburnett/Snappier/security/advisories/GHSA-pggp-6c3x-2xmx", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-835"}]}], "descriptions": [{"lang": "en", "value": "Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1."}, {"lang": "es", "value": "Snappier es una implementaci\u00f3n en C# de alto rendimiento del algoritmo de compresi\u00f3n Snappy. Antes de 1.3.1, Snappier.SnappyStream entra en un bucle infinito inatrapable al descomprimir un flujo Snappy de formato enmarcado malformado de tan solo 15 bytes. Esta vulnerabilidad est\u00e1 corregida en 1.3.1."}], "lastModified": "2026-10-26T14:10:00.130", "sourceIdentifier": "security-advisories@github.com"}