Executive brief
SnailJob is a distributed task retry and scheduling platform used to manage job execution across systems. An authenticated attacker can crash the SnailJob server by submitting a maliciously crafted Zstandard-compressed payload with an inflated decompression size field, causing the JVM to attempt excessive memory allocation and triggering an out-of-memory failure that brings down the service.
Technical details
A deserialization vulnerability exists in the FuryUtil.deserialize() method, which processes base64-encoded Zstandard-compressed task arguments without validating the declared decompressed size. An attacker can manipulate the Zstandard frame header to declare an arbitrarily large frame_content_size value, causing Zstd.decompressedSize() to return an inflated size. When the code attempts to allocate a buffer of this size for decompression, the JVM fails with java.lang.OutOfMemoryError ("Requested array size exceeds VM limit"). The vulnerability requires authentication to store a malicious payload as a retry task argument, but once stored, the denial of service is triggered automatically when the retry task is dispatched. A fix is available and recommended to validate decompressed size against a maximum threshold before allocation.
Affected products
- Aizuda SnailJob 1.7.0
Timeline
- 2026-08-04: disclosed
- 2026-08-04: advisory