TI-2026-32271 Aliases CVE-2026-44302 GHSA-pggp-6c3x-2xmx

Snappier: Infinite loop in SnappyStream decompression on malformed framed input

HIGH 72CWE-835Published 2026-05-12 · Updated 2026-05-18

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-835.

Summary

Snappier is a high performance C# implementation of the Snappy compression algorithm. Prior to 1.3.1, Snappier.SnappyStream enters an uncatchable infinite loop when decompressing a malformed framed-format Snappy stream as small as 15 bytes. This vulnerability is fixed in 1.3.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00316 24th percentileScored 2026-11-07

Fix Fixed Snappier (brantburnett): 1.3.1Snappier (NuGet): 1.3.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
brantburnett	Snappier	before 1.3.1	1.3.1	Patch available	CNA
—	Snappier (NuGet)	before 1.3.1	1.3.1	Patch available	GHSA-pggp-6c3x-2xmx

Snappier Vendorbrantburnett Affected before 1.3.1 Fixed in 1.3.1 Patch available CNA
Snappier (NuGet) Vendor— Affected before 1.3.1 Fixed in 1.3.1 Patch available GHSA-pggp-6c3x-2xmx

Remediation

Fix · CNA Snappier (brantburnett) Fixed in 1.3.1
Fix · GHSA-pggp-6c3x-2xmx Snappier (NuGet) Fixed in 1.3.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-44302
2026-10-03 Alias added: GHSA-pggp-6c3x-2xmx

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-44302

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences