{"id":"ECHO-9602-f49c-093f","modified":"2026-10-22T08:15:05.102259425Z","published":"2026-10-22T07:45:58.046Z","upstream":["CVE-2026-108104","GHSA-2xrm-qggp-hr4m"],"references":[{"type":"WEB","url":"https://advisory.echohq.com/cve/CVE-2026-108104"},{"type":"WEB","url":"https://github.com/xerial/snappy-java/security/advisories/GHSA-c73m-r934-8qvg"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108104"},{"type":"WEB","url":"https://github.com/xerial/snappy-java/commit/139a53090a6662298924fd75d21f4769b4a219ea"},{"type":"WEB","url":"https://github.com/xerial/snappy-java"},{"type":"WEB","url":"https://github.com/xerial/snappy-java/blob/v1.1.10.9/src/main/java/org/xerial/snappy/SnappyFramedInputStream.java#L243"},{"type":"WEB","url":"https://github.com/xerial/snappy-java/releases/tag/v1.1.10.10"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/xerial-snappy-java-1.1.7.4-before-1.1.10.10-double-release-of-pooled-buffers-in-snappyframedinputstream"},{"type":"WEB","url":"https://github.com/advisories/GHSA-2xrm-qggp-hr4m"}],"affected":[{"package":{"name":"org.xerial.snappy:snappy-java","ecosystem":"Echo:Maven","purl":"pkg:maven/org.xerial.snappy/snappy-java"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.10.8+echo.1"}]}],"database_specific":{"source":"https://advisory.echohq.com/osv/ECHO-9602-f49c-093f.json"}}],"schema_version":"1.9.0"}