CVE-2026-69702 Details
Description
SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causing the JVM to attempt an unbounded array allocation and triggering an unrecoverable java.lang.OutOfMemoryError when the task is dispatched through the retry-task pipeline.
A denial-of-service vulnerability has been identified in SnailJob version 1.7.0. The issue arises in the FuryUtil.deserialize helper, where authenticated attackers can cause the server to crash. This is achieved by sending a crafted Zstandard-compressed payload that includes an inflated frame_content_size field in the header. The manipulation leads to unbounded array allocation, causing a java.lang.OutOfMemoryError when the task is processed through the retry-task pipeline.
Users can upgrade to SnailJob version 2.0.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 4, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitee.com/aizuda/snail-job | [email protected] | ProductVendor |
| https://gitee.com/aizuda/snail-job/issues/ICRJMI | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://gitee.com/aizuda/snail-job/releases#release-vsj2.0.0 | [email protected] | Vendor |
| https://www.vulncheck.com/advisories/snailjob-denial-of-service-via-furyutil-deserialize-oom | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Aizuda SnailJob | <= 1.7.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 4, 2026 | New CVE Received | [email protected] |