CVE-2026-69702
Received Received - Intake

SnailJob 1.7.0 Deserialization of Uncontrolled Data DoS

Publication date: 2026-08-04

Last updated on: 2026-08-04

Assigner: VulnCheck

Description
SnailJob 1.7.0 contains a denial of service vulnerability in the FuryUtil.deserialize helper that allows authenticated attackers to crash the server by supplying a crafted Zstandard-compressed payload with an inflated frame_content_size field in the frame header. Attackers can store a base64-encoded Zstandard payload declaring an arbitrarily large decompressed size in a retry task argument, causing the JVM to attempt an unbounded array allocation and triggering an unrecoverable java.lang.OutOfMemoryError when the task is dispatched through the retry-task pipeline.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-04
Last Modified
2026-08-04
Generated
2026-08-04
AI Q&A
2026-08-04
EPSS Evaluated
N/A
NVD
CVE-2026-69702
EUVD
EUVD-2026-52851

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
snailjob snailjob 1.7.0
aizuda snail-job From 1.7.2 (exc)
aizuda snail-job to 1.7.2 (inc)
aizuda snail-job 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-69702 is a denial-of-service vulnerability in SnailJob 1.7.0 affecting the FuryUtil.deserialize function. Authenticated attackers can exploit it by sending a crafted Zstandard-compressed payload with an inflated frame_content_size field. This causes the JVM to attempt unbounded memory allocation during decompression, leading to an OutOfMemoryError and server crash.

Detection Guidance

Monitor for OutOfMemoryError exceptions in SnailJob logs, especially during task retry operations. Check for unusually large Zstandard payloads in retry task arguments by inspecting the database or logs for base64-encoded data with inflated frame_content_size fields.

Impact Analysis

This vulnerability allows authenticated attackers to crash the SnailJob server by triggering an OutOfMemoryError. This disrupts task scheduling and retry operations, potentially causing service unavailability for distributed task management systems relying on SnailJob.

Mitigation Strategies

Upgrade SnailJob to version 2.0.0 or later. Implement input validation to enforce a maximum decompressed size limit (e.g., 8192 bytes) before processing Zstandard payloads. Restrict database access to prevent unauthorized task modifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69702. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart