PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44302 brantburnett CVE debrief

A denial-of-service vulnerability exists in Snappier, a high-performance C# implementation of the Snappy compression algorithm. Versions prior to 1.3.1 are affected by an uncatchable infinite loop that triggers when decompressing malformed framed-format Snappy streams. The vulnerability can be exploited with input as small as 15 bytes, making it trivial to trigger. The CVSS 3.1 score of 7.5 (HIGH) reflects network attack vector, low attack complexity, no required privileges or user interaction, and high availability impact. The root cause is classified under CWE-835 (Loop with Unreachable Exit Condition). The vulnerability was disclosed via GitHub Security Advisory and published to NVD on May 12, 2026, with subsequent modification on May 18, 2026.

Vendor
brantburnett
Product
Snappier
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-18
Advisory published
2026-05-12
Advisory updated
2026-05-18

Who should care

Organizations using Snappier library for Snappy compression in .NET applications, particularly those exposing decompression of untrusted data streams via network-facing services or file upload handlers.

Technical summary

Snappier.SnappyStream in versions prior to 1.3.1 enters an uncatchable infinite loop when processing malformed framed-format Snappy streams. The vulnerability is triggered by crafted input as small as 15 bytes, resulting in complete CPU exhaustion and denial of service. The issue stems from improper loop control logic (CWE-835) during stream decompression. No authentication or user interaction is required for exploitation. The fix in version 1.3.1 addresses the loop exit condition to prevent indefinite execution.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Snappier to version 1.3.1 or later to remediate the infinite loop vulnerability.
  • Review applications using Snappier.SnappyStream for untrusted input handling and implement input validation where possible.
  • Monitor for anomalous CPU consumption patterns that may indicate exploitation attempts against SnappyStream decompression endpoints.
  • If immediate patching is not feasible, consider implementing resource limits or timeouts on decompression operations as a temporary mitigation.

Evidence notes

Official CVE record published 2026-05-12; modified 2026-05-18. GitHub Security Advisory GHSA-pggp-6c3x-2xmx confirms fix in version 1.3.1. CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. CWE-835 identified as weakness type.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44302 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44302

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44302 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44302

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.