CVE-2026-69702

SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causing the JVM to attempt an unbounded array allocation and triggering an unrecoverable java.lang.OutOfMemoryError when the task is dispatched through the retry-task pipeline.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://gitee.com/aizuda/snail-job
https://gitee.com/aizuda/snail-job/issues/ICRJMI
https://gitee.com/aizuda/snail-job/releases#release-vsj2.0.0
https://www.vulncheck.com/advisories/snailjob-denial-of-service-via-furyutil-deserialize-oom

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) SnailJob 1.7.0 contiene una vulnerabilidad de denegación de servicio en el asistente FuryUtil.deserialize que permite a atacantes autenticados colapsar el servidor al suministrar una carga útil Zstandard comprimida y manipulada con un campo ’frame_content_size’ inflado en la cabecera del marco. Los atacantes pueden almacenar una carga útil Zstandard codificada en base64 declarando un tamaño descomprimido arbitrariamente grande en un argumento de tarea de reintento, lo que provoca que la JVM intente una asignación de array ilimitada y desencadenando un ’java.lang.OutOfMemoryError’ irrecuperable cuando la tarea se despacha a través de la tubería de tareas de reintento.

Information

Published : 2026-08-04 19:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-69702

Mitre link : CVE-2026-69702

CVE.ORG link : CVE-2026-69702

JSON object : View

Products Affected

No product.

CWE

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-69702", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69702", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-05T19:37:09.655238Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "aizuda", "product": "SnailJob (snail-job)", "versions": [{"status": "affected", "version": "1.7.0", "versionType": "semver"}], "defaultStatus": "affected"}]}], "published": "2026-08-04T19:16:53.980", "references": [{"url": "https://gitee.com/aizuda/snail-job", "source": "disclosure@vulncheck.com"}, {"url": "https://gitee.com/aizuda/snail-job/issues/ICRJMI", "source": "disclosure@vulncheck.com"}, {"url": "https://gitee.com/aizuda/snail-job/releases#release-vsj2.0.0", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/snailjob-denial-of-service-via-furyutil-deserialize-oom", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causing the JVM to attempt an unbounded array allocation and triggering an unrecoverable java.lang.OutOfMemoryError when the task is dispatched through the retry-task pipeline."}, {"lang": "es", "value": "SnailJob 1.7.0 contiene una vulnerabilidad de denegaci\u00f3n de servicio en el asistente FuryUtil.deserialize que permite a atacantes autenticados colapsar el servidor al suministrar una carga \u00fatil Zstandard comprimida y manipulada con un campo \u2019frame_content_size\u2019 inflado en la cabecera del marco. Los atacantes pueden almacenar una carga \u00fatil Zstandard codificada en base64 declarando un tama\u00f1o descomprimido arbitrariamente grande en un argumento de tarea de reintento, lo que provoca que la JVM intente una asignaci\u00f3n de array ilimitada y desencadenando un \u2019java.lang.OutOfMemoryError\u2019 irrecuperable cuando la tarea se despacha a trav\u00e9s de la tuber\u00eda de tareas de reintento."}], "lastModified": "2026-10-24T16:10:00.153", "sourceIdentifier": "disclosure@vulncheck.com"}