Executive brief
Snappier is a high-performance library used by C# applications to compress and decompress data. A flaw in the library allows an attacker to provide a specially crafted file or data stream that causes the application to enter an infinite loop. This results in a denial-of-service (DoS) condition where the application stops responding and consumes excessive processor resources until it is manually restarted.
Technical details
A vulnerability classified as CWE-835 (Loop with Unreachable Exit Condition) exists in Snappier's SnappyStream component. When processing a malformed framed-format Snappy stream (as small as 15 bytes), the SnappyStreamDecompressor.Decompress method repeatedly calls Crc32CAlgorithm.Append without reaching a termination state. This manifests as a userspace busy loop that cannot be caught by standard try/catch blocks because no exception is thrown. An attacker can exploit this remotely if the application decompressing the data accepts input from untrusted network sources. The issue is resolved in version 1.3.1.
Affected products
- brantburnett Snappier < 1.3.1
Timeline
- 2026-04-28: advisory: GitHub Security Advisory published by maintainer
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fix released in version 1.3.1