CVE-2026-44302: Snappier Denial of Service Vulnerability

CVE-2026-44302 Overview

CVE-2026-44302 is a denial-of-service vulnerability in Snappier, a high-performance C# implementation of the Snappy compression algorithm. The flaw resides in the Snappier.SnappyStream class, which enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream. An attacker can trigger the condition with a crafted payload as small as 15 bytes. The issue affects all versions prior to 1.3.1 and is tracked under CWE-835: Loop with Unreachable Exit Condition.

Critical Impact

Remote attackers can cause an unrecoverable infinite loop and full CPU exhaustion in applications that decompress untrusted Snappy framed streams, leading to denial of service.

Affected Products

• Snappier versions prior to 1.3.1
• .NET applications consuming Snappier.SnappyStream for framed-format decompression
• Downstream libraries and services that accept attacker-controlled Snappy streams

Discovery Timeline

• 2026-05-12 - CVE-2026-44302 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-44302

Vulnerability Analysis

Snappier implements the Snappy framed stream format, which wraps compressed payloads in chunk headers that identify chunk type and length. The SnappyStream decompression path fails to detect a specific malformed chunk arrangement and continues reading without advancing the stream position or terminating. This produces an infinite loop that the calling application cannot interrupt through normal exception handling. The vulnerable code path runs entirely within decompression logic, so any consumer that pipes untrusted bytes into SnappyStream inherits the exposure.

Root Cause

The root cause is a missing exit condition in the framed-stream parsing loop [CWE-835]. When the parser encounters the malformed chunk sequence, the loop's termination predicate is never satisfied, and no exception is raised. Because the loop blocks the calling thread without yielding a catchable error, application-level timeouts and try/catch blocks around the decompression call do not recover the thread. The minimum reproducing payload is only 15 bytes, which makes the trigger trivial to deliver over any transport that carries compressed data.

Attack Vector

The vulnerability is reachable over the network with no authentication and no user interaction. An attacker submits a crafted 15-byte (or larger) framed Snappy stream to any endpoint that decompresses Snappy data using Snappier.SnappyStream. Common exposure points include message queues, RPC frameworks, database drivers, log ingestion pipelines, and HTTP services that accept Snappy-encoded request bodies. Each malicious request consumes a worker thread indefinitely, and a small number of concurrent requests can exhaust the thread pool. The vulnerability does not affect confidentiality or integrity, but availability impact is high.

No verified proof-of-concept code is published. The maintainers describe the trigger in the GitHub Security Advisory GHSA-pggp-6c3x-2xmx.

Detection Methods for CVE-2026-44302

Indicators of Compromise

• Worker threads or async tasks stuck at 100% CPU inside Snappier.SnappyStream decompression frames in thread dumps.
• Sudden saturation of the .NET thread pool following ingestion of small (<32 byte) Snappy-encoded payloads.
• HTTP, gRPC, or message-queue requests carrying Snappy content that never produce a response and never time out cleanly.

Detection Strategies

• Inventory all .NET services that reference the Snappier NuGet package and identify versions earlier than 1.3.1.
• Instrument decompression code paths with hard timeouts on a separate thread or cancellation token monitored externally, since in-loop cancellation is not honored.
• Correlate process-level CPU spikes with inbound traffic that carries Content-Encoding: snappy or framed Snappy magic bytes 0xff 0x06 0x00 0x00 0x73 0x4e 0x61 0x50 0x70 0x59.

Monitoring Recommendations

• Alert on per-thread CPU time exceeding expected decompression duration for Snappy-handling services.
• Track NuGet dependency manifests (packages.lock.json, *.csproj) in CI to flag vulnerable Snappier versions before deployment.
• Monitor application logs for stalled request IDs and missing response telemetry on endpoints that accept compressed input.

How to Mitigate CVE-2026-44302

Immediate Actions Required

• Upgrade Snappier to version 1.3.1 or later in all .NET projects and rebuild dependent services.
• Audit transitive dependencies, since Snappier is commonly pulled in by Couchbase, Kafka, and Parquet client libraries.
• Apply request-size and rate limits to endpoints that decompress Snappy data until the patched version is deployed.

Patch Information

The maintainers fixed the issue in Snappier 1.3.1. Update the package reference in .csproj or Directory.Packages.props and restore dependencies. Full details are available in the Snappier GitHub Security Advisory.

Workarounds

• Reject Snappy-encoded input from untrusted sources at an upstream proxy until the patch is applied.
• Wrap SnappyStream reads in a separate worker process or container with a strict CPU-time limit, so the host can terminate runaway decompression.
• Validate framed-stream chunk headers against expected length and type ranges before passing buffers to the decompressor.

# Configuration example
dotnet add package Snappier --version 1.3.1
dotnet restore
dotnet list package --vulnerable --include-transitive