-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a denial-of-service (DoS) weakness in VictoriaMetrics' handling of snappy-compressed data. The root cause is the use of github.com/golang/snappy.Decode without pre-validating the uncompressed data size declared in the snappy block header. A malicious actor could send a small, crafted payload that claims a very large uncompressed size, causing the application to attempt a massive memory allocation, leading to an Out-Of-Memory (OOM) crash.
The security patch, commit 51b44afd34d2c9a392d4ebedeeb5b4a7f5beca24, addresses this by introducing a custom wrapper function, lib/encoding/snappy.Decode. This new function first calls snappy.DecodedLen to check the declared uncompressed size against a provided limit before proceeding with the actual decompression. If the size exceeds the limit, it returns an error, preventing the dangerous memory allocation.
The analysis identified three key functions where this unsafe decoding occurred:
stream.Parse: Processes incoming data for the Prometheus remote write endpoint.protoparserutil.ReadUncompressedData: A general-purpose utility for reading compressed data.snappyReader.Reset: A method for handling snappy-encoded data streams.These functions were all modified in the patch to replace the direct, unsafe call to snappy.Decode with the new, size-limited wrapper. During an exploit, these are the functions that would process the malicious input, and their names would likely appear in a stack trace or runtime profile just before the OOM error.
stream.Parselib/protoparser/promremotewrite/stream/streamparser.go
protoparserutil.ReadUncompressedDatalib/protoparser/protoparserutil/compress_reader.go
snappyReader.Resetlib/protoparser/protoparserutil/compress_reader.go
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/VictoriaMetrics/VictoriaMetrics | go | >= 1.123.0, < 1.129.1 | 1.129.1 |
| github.com/VictoriaMetrics/VictoriaMetrics | go | >= 1.111.0, < 1.122.8 | 1.122.8 |
| github.com/VictoriaMetrics/VictoriaMetrics |
| go |
| >= 1.0.0, < 1.110.23 |
| 1.110.23 |
Ongoing coverage of React2Shell