{"id":"CVE-2026-69702","title":"SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size …","summary":"SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-789"],"vendor":"aizuda","product":"SnailJob (snail-job)","affected":["snailjob_snail-job 1.7.0"],"published":"2026-08-04","updated":"2026-09-24","sourceUpdated":"2026-09-24T20:43:32.537","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-69702","references":[{"url":"https://gitee.com/aizuda/snail-job","label":"disclosure@vulncheck.com"},{"url":"https://gitee.com/aizuda/snail-job/issues/ICRJMI","label":"disclosure@vulncheck.com"},{"url":"https://gitee.com/aizuda/snail-job/releases#release-vsj2.0.0","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/snailjob-denial-of-service-via-furyutil-deserialize-oom","label":"disclosure@vulncheck.com"}],"tags":["nvd","cve.org"],"epss":0.00548,"epssPercentile":0.43453,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-05T19:37:09.655238Z"},"ingestedAt":"2026-09-24T15:45:56.717Z","slug":"CVE-2026-69702","body":"## Overview\n\nSnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causing the JVM to attempt an unbounded array allocation and triggering an unrecoverable java.lang.OutOfMemoryError when the task is dispatched through the retry-task pipeline.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}