Skip to content
OpenAdvisories
High · 7.5 CVE-2026-44302 EUVD-2026-29863GHSA-pggp-6c3x-2xmx

Snappier: Infinite loop in SnappyStream decompression on malformed framed input

Published May 12, 2026 · Updated May 18, 2026 · Assigned by GitHub_M

Description

Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1.

Affected products

VendorProductAffectedFixed
brantburnett Snappier < 1.3.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet Snappier < 1.3.1 1.3.1 GHSA-pggp-6c3x-2xmx

References